The IT Specialist has concluded that users have unauthorized access to the system, but not the system logs. The IT Specialist has performed mitigating procedures to obtain sufficient persuasive evidence that those specific users did not actually log onto the system during the period of unauthorized access, therefore the potential exposure of the deficiency is mitigated. In this scenario, we may conclude that a. we need to modify our audit plan b. it will not be appropriate to rely on the system logs fort the mitigating procedures c. the IT risk related to the GITC deficiency is addressed for the financial statement audit d. the IT risk related to the GITC deficiency is unaddressed for the financial statement audit