What should an IS auditor do if he or she observes that project-approval procedures do not exist?

A.
Advise senior management to invest in project-management training for the staff

B.
Create project-approval procedures for future project implementations

C.
Assign project leaders

D.
Recommend to management that formal approval procedures be adopted and documented

Explanation:
If an IS auditor observes that project-approval procedures do not exist, the IS
auditor should recommend to management that formal approval procedures be adopted and
documented.