After an external IS audit, which of the following should be IT management’s MAIN consideration when determining the prioritization of follow-up activities?

A. The amount of time since the initial audit was completed.
B. The materiality of the reported findings
C. The availability of the external auditors
D. The scheduling of major changes in the control environment