An Internal Auditor is reviewing the controls related to goods and devices in the acute care hospital operating room. Which finding should be classified as a high risk due to regulatory compliance?

a$.$ Vendors did not always provide the same quality goods to the hospital.

b$.$ Controls related to vendor contracts need improvement to address the scenario where the contract expires and is still being negotiated.

c$.$ Controls are not in place to identify overcharges from vendors, including investigating spikes in the price paid.

d$.$ The returned medical device process is not functioning effectively and requires enhancement.