According to the ISACA CISA Study Manual (2020), "incorrectly classifying information or not implementing adequate controls to protect the information is a major risk" (p. 328). Therefore, the IS auditor's greatest concern should be that controls to adequately safeguard the data may not be applied.