When evaluating the collective effect of preventive, detective or corrective controls within a process, an IS auditor should be aware of which of the following? 
A、The point at which controls are exercised as data flow through the system 
B、Only preventive and detective controls are relevant 
C、Corrective controls can only be regarded as compensating 
D、Classification allows an IS auditor to determine which controls are missing