When continuous monitoring systems are being implemented, an IS auditor should FIRST identify:
A . the location and format of output files
B . applications that provide the highest financial risk
C . high-risk areas within the organization
D . the controls on which to focus
Answer: D