In a small organization, an IS auditor finds that security administration and system analysis functions are performed by the same employee. Which of the following is the MOST significant finding? 

Answer options:

A. The security policy has not been updated to reflect the situation.
B. The employee`s formal job description has not been updated.
C. The employee has not signed the security policy.
D. The employee`s activities are not independently reviewed.

D