Which of the following findings would be of GREATEST concern to an IS auditor reviewing an organization’s newly implemented online security awareness program?

A. Only new employees are required to attend the program
B. The timing for program updates has not been determined
C. Metrics have not been established to assess training results
D. Employees do not receive immediate notification of results