An audit observation states the following: "Despite the rules of the organization there is no approved credit risk management policy in the subsidiary. The subsidiary is concluding contacts with clients who have very high credit ratings. The internal audit team tested 50 contacts and 17 showed clients with a poor credit history" Which of the following components are missing in the observation?

(A). Cause and effect. (B). Effect and criteria (C). Condition and cause (D). Criteria and condition