According to IIA guidance, when performing a compliance audit of data security standards for a large e-commerce retailer, which of the following would represent the least likely area of risk exposure?

Choose the correct option from the given list.

Operational risks.

Change or configuration risks.