For an auditor auditing an organization's cloud resources, which of the following should be of...

The organization does not have separate policies for governing its cloud environment.

The organization's IT team does not include resources with cloud certifications.

The organization does not perform periodic reviews or control monitoring for its cloud environment, but it has a documented audit plan and performs an audit for its cloud environment every alternate year.

The risk management team reports to the head of audit.