Which of the following would be of GREATEST concern to an IS auditor when auditing a small organization's purchasing department?

A. The organization lacks a purchasing officer with experience in purchasing activities.
B. Purchases can be approved after expenses have already been incurred.
C. Some members of the department can request and approve payments for purchase requests.
D. Purchasing procedures and processes have not been updated during the past two years.