During an investigation of transactions in a core banking system, fraudulent transactions are discovered that will require the involvement of law enforcement. Which of the following should be done FIRST?

A. Ensure evidence is preserved.
B. Initiate incident response procedures.
C. Evaluate the business impact.
D. Notify internal audit management.