An IS auditor learns that a business owner violated the organization's security policy by creating a web page with access to production data. The auditor's NEXT step should be to: • assess the sensitivity of the production data. • shut down the web page. escalate to senior management. • determine if sufficient access controls exist.