As part of a quality assurance initiative, an organization has engaged an external auditor to evaluate the internal IS audit function. Which of the following observations should be of MOST concern?

A. Audit reports are not approved by the audit committee.
B. Audit reports do not state they are conducted in accordance with industry standards.
C. The audit team is not sufficiently leveraging data analytics.
D. Audit engagements are not risk-based.