What should be an IS auditor's NEXT course of action when a review of an IT organizational structure reveals IT staff members have duties in other departments?

A. Determine whether any segregation of duties conflicts exist.
B. Recommend that segregation of duties controls be implemented.
C. Report the issue to human resources (HR) management.
D. Immediately report a potential finding to the audit committee.