Which of the folllowing is an appropriate conclusion that can be drawn when the internal auditor idnetifies an observation from testing controls?
A. The process objectives cannot be achieved.
B. The area may be vulnerable to fraud
C. Certain risk are not effectively mitigated
D. Overall, the process is not operating effectively
C. Certain risk are not effectively mitigated