Which of the following would be MOST useful to an IS auditor when making recommendations to enable continual improvement of IT processes over time?

An IT incident log identifies specific operational problems but does not provide a comprehensive framework for systematic process improvement across all IT functions.

An IT risk register documents potential threats and vulnerabilities, helping prioritize risk mitigation, but it is not a direct tool for assessing and improving the overall maturity of IT processes.

A maturity model, such as CMMI or COBIT, provides a structured framework for assessing the current state of an organization's IT processes and identifying specific areas and steps for improvement to reach higher levels of capability and efficiency. This allows for a roadmap for continual improvement.

Benchmarking studies compare an organization's performance against peers, identifying gaps, but they don't inherently provide a structured framework or methodology for how to improve processes to close those gaps.