Which of the following observations should be of GREATEST concern to an IS auditor reviewing...

IT application owners having sole responsibility for architecture approval (B) is a major concern because it indicates a lack of oversight and segregation of duties. EA decisions should be reviewed by a cross-functional governance body to ensure alignment with security, compliance, and business objectives.

Other options:

The CIO chairing the review board (A) may indicate centralized leadership but is not inherently a risk.

EA governing non-IT projects (C) may indicate scope expansion but is not a security risk.

Security requirements being reviewed (D) is a best practice and not a concern.