An organization has purchased a replacement mainframe computer to cope with the demands of increased business. Which of the following should be the PRIMARY concern of an IS auditor?

A. The disaster recovery plan has been reviewed and updated.
B. Application access controls are adequate.
C. Appropriate tender evaluation processes have been followed.
D. The procurement is within the planned budget for the year.