An IS auditor is performing a post-implementation review of a system deployed two years ago. Which of the following findings should be of MOST concern to the auditor?

A. Maintenance costs were not included in the project lifecycle costs.
B. Benefits as stated in the business case have not been realized.
C. Workarounds due to remaining defects had to be used longer than anticipated.
D. The system has undergone several change requests to further extend functionality.