An organization has a mature control environment but limited audit resources. Given this scenario, on which of the following should internal auditors focus their testing?

a. Detective compensating controls

b. Preventive compensating controls

c. Detective key controls

d. Preventive key controls