During an audit of an organization’s incident management process, an IS auditor learns that the security operations team includes detailed reports of recent attacks in its communications to employees. Which of the following is the GREATEST concern with this situation?

A. Employees may fail to understand the severity of the threats.
B. The reports may be too complex for a nontechnical audience.
C. Employees may misuse the information in the reports.
D. There is not a documented procedure to communicate the reports.