Which of the following statements would not be correct regarding the authori- zation function as implemented in an organization? 

a. Blanket authorizations can be implemented in computer systems on the ap- proval of the user area. All changes to the authorization parameters embodied in the computer should be made only on written, documented requests by the user area responsible for the authorization. 

b. General authorizations may be delegated by top management in the form of company policies. 

c. The auditor can rely on an authorization control only when there is documen- tary evidence of the authorization in the form of a signature or an authorizer's initials somewhere in the system. 

d. Effective implementation of a "password" scheme to limit access to computer records is a form of authorization control.