Which of the following is the STRONGEST indication that controls implemented as part of a risk action plan are not effective?
A . A security breach occurs.
B . Internal audit identifies recurring exceptions.
C . Changes are put into production without management approval.
D . A sample is used to validate the action plan.
Answer: B