A vendor service level agreement (SLA) requires backups to be physically secured. An IS audit of the backup system revealed a number of the backup media were missing. Which of the following should be the auditor’s NEXT step?

A. Recommend a review of the vendor’s contract.
B. Recommend identification of the data stored on the missing media.
C. Notify executive management.
D. Include the missing backup media finding in the audit report.