An enterprise's internal audit group has scheduled a control review of a payroll system project but has been told to wait until the system is implemented. Which of the following is the GREATEST risk a

A delay in developing new key performance indicators (KPIs) is a management reporting issue, not the greatest risk associated with the control review itself being delayed.

Continued dependency on compliant legacy systems is a pre-existing condition, not a direct risk caused by delaying the audit of the new payroll system.

When control deficiencies are identified after system implementation, the cost to remediate them is substantially higher due to the need for rework, system modifications, and potential disruption to operational services, compared to addressing issues during earlier project phases. Late detection means issues are more deeply embedded and expensive to extract.

Lack of adherence to industry best practices is a potential cause of deficiencies, but the greatest risk of delaying the audit is the cost consequence of finding those deficiencies late.