An auditor finds that an organization's ITGC framework is comprehensive but has not been updated in four years. Significant technology changes have occurred, including migration to cloud infrastructure and adoption of new ERP modules. The primary risk is:
- The ITGC documentation will fail to impress external auditors.
- The existing ITGC framework may not address risks introduced by new technologies, creating unmitigated control gaps. (correct answer)
- Employees will not be familiar with the outdated ITGC documentation.
- The organization may not achieve the highest rating in IT maturity assessments.
Explanation: ITGCs must evolve with technology - a cloud migration and new ERP introduce new access paths, change mechanisms, and operational risks that the old framework may not address. Answer B is correct. Auditor impressions (A), employee familiarity (C), and maturity ratings (D) are secondary concerns.