If a management accountant is concerned about the ethical implications of certain activities being undertaken by employees they are supervising, specifically the sharing of passwords, what is the most appropriate way to address these concerns?

A: Management has no tangible way to help ensure that password policies have been put into place and have been enforced, so it is not worth investing time and financial resources on these areas.

B: The most appropriate way to manage information technology risks, especially those related to password policies and procedures, is to train, educate, and implement policies to help ensure employees are aware of the potential pitfalls of sharing passwords with other people.

C: Since most large organizations contain a dedicated internal audit department and functional group anyway, it is not the responsibility of management accountants to worry about internal control issues.

D: To address any technologyrelated control issues, the most appropriate way to proceed would be to implement increased analytical tools to help track employee behavior.