Which of the following is an appropriate conclusion that can be drawn when the internal auditor identifies an observation from testing controls?
a. The process objectives cannot be achieved.
b. The area may be vulnerable to fraud.
c. Certain risks are not effectively mitigated.
d. Overall, the process is not operating effectively.