Which of the following would be of GREATEST concern to an IS auditor evaluating governance over open source development components?

A. The development project has gone over budget and time
B. The open source development components do not meet industry best practices
C. The software is not analyzed for compliance with organizational requirements
D. Existing open source policies have not been approved in over a year