Which of the following must be in place before an IS auditor initiates audit follow-up activities?

A. A heat map with the gaps and recommendations displayed in terms of risk
B. A management response in the final report with a committed implementation date
C. Supporting evidence for the gaps and recommendations mentioned in the audit report
D. Available resources for the activities included in the action plan