Which of the following is MOST important for the IS auditor to verify when reviewing the development process of a security policy? 

Answer options:

A. Evidence of active involvement of key stakeholders
B. Output from the enterprise`s risk management system
C. Identification of the control framework
D. Evidence of management approval

D