When an audit identifies gaps in a risk management program, what is the typical next step?

When an audit identifies gaps in a risk management program, what is the typical next step?

• A. Findings are documented and archived without further action.
• B. The audit is considered complete with no follow-up.
• C. A gap is identified and corrective actions are tracked for closure.
• D. Audits are repeated immediately to confirm issues.

Answer: (C)