Which of the following would be considered a significant deficiency in an organization's control environment? 

a. The internal audit function is outsourced to a public accounting firm that is not performing the financial statement audit. 

b. Management has approximately 50 percent of its compensation in stock options, but the options cannot be exercised for five years.