An IS auditor conducts a review of a third-party vendor’s reporting of key performance indicators (KPIs). Which of the following findings should be of MOST concern to the auditor?

A. Some KPIs are not documented.
B. KPIs have never been updated.
C. KPIs data is not being analyzed.
D. KPIs are not clearly defined.