When continuous monitoring systems are being implemented, an IS auditor should FIRST identify: 

Answer options:

A. the location and format of output files
B. applications that provide the highest financial risk
C. high-risk areas within the organization
D. the controls on which to focus

D