An IS auditor observed that most users do not comply with physical access controls. The business manager has explained that the control design is inefficient. What is the auditor`s BEST course of action? 

Answer options:

A. Recommend changing the access control process to increase efficiency.
B. Identify the impact of control failure and report the finding with a risk rating.
C. Redesign and retest the physical access control.
D. Work with management to design and implement a better control.

B