Which of the following would be of MOST concern for an IS auditor evaluating the design of an organization`s incident management processes? 

Answer options:

A. Metrics are not reported to senior management.
B. Service management standards are not followed.
C. Expected time to resolve incidents is not specified.
D. Prioritization criteria are not defined.

D