Which of the following BEST indicates a need to review an organization’s information security policy?

A. Completion of annual IT risk assessment
B. Increasing complexity of business transactions
C. Increasing exceptions approved by management
D. High number of low-risk findings in the audit report