An internal audit has revealed a large number of incidents for which root cause analysis has not been performed. Which of the following is MOST important for the IS auditor to verify to determine whether there is an audit issue?

A. Cost of resolving the incidents
B. Severity level of the incidents
C. Time required to resolve the incidents
D. Frequency of the incidents