Which of the following provides an IS auditor the MOST assurance that an organization is compliant with legal and regulatory requirements?

A. The IT manager is responsible for the organization’s compliance with legal and regulatory requirements.
B. Controls associated with legal and regulatory requirements have been identified and tested.
C. Senior management has provided attestation of legal and regulatory compliance.
D. There is no history of complaints or fines from regulators regarding noncompliance.