Which one of the following is true with regard to audits and assessments?

A. Assessments typically result in a pass or fail grade, whereas audits result in a list of recommendations to improve controls.

B. Assessments are attributive and audits are not.

C. An audit is typically a precursor to an assessment.

D. An audit may be conducted independently of an organization, whereas internal IT staff always conducts an IT security assessment.

E. Audits can result in blame being placed upon an individual.