When preparing to evaluate the effectiveness of an organization’s IT strategy, an IS auditor should FIRST review:

A. information security procedures.
B. the IT governance framework.
C. the most recent audit results.
D. IT processes and procedures.