Which of the following risks is the result of an organization failing to create and...

If an organization does not establish a social media strategy, it is likely to react to events rather than proactively manage communication, brand reputation, customer engagement, compliance, and crisis response. Option A is too restrictive because not every employee post must necessarily be vetted by a department. Option B may occur in certain regulated contexts, but it is not the broad strategic risk described. Option C relates to internal communication and governance culture, not specifically social media strategy. Internal auditors reviewing social media governance should assess policies, ownership, approval processes, monitoring, escalation, employee guidance, legal compliance, and incident response. The key risk of lacking strategy is reactive and inconsistent use. Therefore, Option D is correct.