During a follow-up, an IS auditor learns the auditee has not implemented agreed-upon monitoring controls over a critical legacy system due to a business decisio...