An IS auditor reviews change control tickets and finds an emergency change request where an IT manager approved the change, modified the code on the production platform, and resolved the ticket. Which of the following should be the auditor’s GREATEST concern?

A. There was no follow-up approval from the business.
B. The change was made less than an hour after the request.
C. There was no testing prior to making the change in production.
D. The IT manager performed the change and resolved the ticket.