Which of the following would be an auditor’s GREATEST concern when reviewing data inputs from spreadsheets into the core finance system?

A. Undocumented code formats data and transmits directly to the database.
B. There is not a complete inventory of spreadsheets, and file naming is inconsistent.
C. Spreadsheets are accessible by all members of the finance department.
D. The department data protection policy has not been reviewed or updated for two years.