If an IS auditor observes that proper project-approval procedures do not exist, the auditor should:

A. Provide detailed procedures that the auditor recommends for implementation.
B. Look for evidence of other undocumented approval procedures.
C. Recognize that the lack of proper project-approval procedures is a risk indicator for insufficient project-management skills, and recommend project-management training as a compensatory control.
D. Recommend to management that proper project-approval procedures be adopted and documented.

Answer: D. Recommend to management that proper project-approval procedures be adopted and documented.