During an audit of a software development organization, an auditor found that the organization did not properly follow industry best practices including peer review
and board approval prior to moving applications into the production environment. The auditor recommended adapting a formal process incorporating these steps.
To remediate the finding, the organization implemented:

A.
incident management.

B.
a configuration management board.

C.
asset management.

D.
change management.