Which audit technique provides the GREATEST assurance that incident management procedures are effective?

A. Determining whether incidents are categorized and addressed
B. Performing comprehensive vulnerability scanning and penetration testing
C. Comparing incident management procedures to best practices
D. Evaluating end-user satisfaction survey results