Which of the following indicates the HIGHEST level of maturity for an organization's information systems internal control environment?

A. Controls are regularly evaluated using a formally documented process.
B. Controls are adequately documented and control exceptions are captured.
C. The operation of controls depends on employee knowledge.
D. Operational effectiveness is evaluated upon management request.