Which of the following should be of GREATEST concern to an IS auditor reviewing an organization's business continuity plan (BCP)?
A. The BCP has not been tested since it was first issued.
B. The BCP is not version-controlled.
C. The BCP's contact information needs to be updated.
D. The BCP has not been approved by senior management.