Which of the following is the BEST way to address an IT audit finding that many enterprise application updates lack appropriate documentation?

Lack of documentation for application updates is a direct symptom of inadequate or unenforced change control procedures, which are designed to ensure all changes, including updates, are properly planned, approved, implemented, and documented to maintain system integrity and auditability. By strictly enforcing these procedures, all necessary documentation will become a mandatory output of the change process.

Software quality audits focus on the functionality and performance of the software itself, not primarily on the administrative documentation of updates.

Reviewing the application development life cycle is a broader initiative; the immediate and specific problem of missing update documentation is best fixed by tightening change control.

Adding change control to the risk register acknowledges the risk but does not implement the control necessary to resolve the current audit finding.