An organization holds a single management review only when its certification audit approaches, roughly every three years. Why is this likely insufficient?

• A.Reviews must occur at planned intervals appropriate to keep the ISMS suitable, adequate and effective, and a three-year gap rarely supports timely decisions
• B.Reviews must occur after each surveillance audit by the certification body, and a three-year gap breaches the certificate conditions
• C.Management reviews must be held monthly by the CISO, and a gap of several months breaches the monitoring requirement
• D.Reviews must be timed with the budget cycle, and a three-year gap prevents the auditors from sampling the minutes