Which of the following observations should be of GREATEST concern to an IS auditor reviewing a recently implemented database system that automates the administration of clients' pension plans at a financial institution? Clients are able to view their accounts and plan details via a web portal A privacy impact assessment was not conducted prior to the implementation. Policies and procedures related to the retention of client data have not been documented Clients' consent was not obtained for the intended processing of their personal