in which of the following circumstances is a direct control more likely to be appropriate or effective in addressing an IT risk a. the affected system data is reconciled to external sources b. the affected system data is reconciled to internal sources, which are affected by the deficiency c. the affected system data is reviewed in a high-level fluctuation analysis by management d. the output from the affected system is reviewed by management and is dependent on IUC impacted by the affected system