Among the following statements, choose an incorrect statement.
a) Narrow security scope does not assess IT systems that are indirectly associated with the external framework's scope.
b) The internal-facing audit report presents the results of the validation audit to external auditors and regulators.
c) A manual audit process can be cheaper than installing a new security technology
d) For effective manual controls, an enterprise needs to document who is responsible for maintaining them.