An IS auditor has completed a service level management audit related to order management services provided by a third party. Which of the following is the MOST significant finding?

A. The third party has offshore support arrangements.
B. Penalties for missing service levels are limited.
C. The service level agreement does not define how availability is measured.
D. Service desk support is not available outside the company’s business hours.