Which of the following is the BEST IS audit strategy?

A. Perform audits based on impact and probability of error and failure.
B. Cycle general control and application audits over a two-year period.
C. Conduct general control audits annually and application audits in alternating years.
D. Limit audits to new application system developments.