Which of the following would an IS auditor consider to be the MOST significant risk associated with a project to reengineer a business process?

A. The negative impact of change may not be documented.
B. The project manager is inexperienced in information systems.
C. Existing controls may be weakened or removed.
D. Existing baseline processes may not be reported to management.