An IS auditor is reviewing security controls related to collaboration tools for a business unit responsible for intellectual property and patents. Which of the following observations should be of MOST concern to the auditor?

A. Training was not provided to the department that handles intellectual property and patents.
B. Logging and monitoring for content filtering is not enabled.
C. The collaboration tool is hosted and can only be accessed via an Internet browser.
D. Employees can share files with users outside the company through collaboration tools.