An organization is developing a web portal using some external components. Which of the following should be of MOST concern to an IS auditor?

A. Open-source components were integrated during development.
B. Some of the developers are located in another country.
C. The organization has not reviewed the components for known exploits.
D. Staff require additional training in order to perform code review.