An auditor anticipates assessing control risk at a low level in an IT environment. Under these circumstances, on which of the following controls would the auditor initially focus?

A. general controls

B. output controls

C. data capture controls

D. application controls