An IS auditor is reviewing the results of a business process improvement project. Which of the following should be performed FIRST?

A. Evaluate control gaps between the old and the new processes.
B. Develop compensating controls.
C. Document the impact of control weaknesses in the process.
D. Ensure that lessons learned during the change process are documented.