An IS auditor finds that application servers had inconsistent configurations leading to potential security vulnerabilities. Which of the following should the auditor recommend FIRST?

A. Enforce server baseline standards.
B. Improve change management processes using a workflow tool.
C. Hold the application owner accountable for monitoring metrics.
D. Use a single vendor for the application servers.