What is the greatest risk for an organization if no information security policy has been defined?

A: If everyone works with the same account, it is impossible to find out who worked on what. B: Information security activities are carried out by only a few people. C: Too many measures are implemented. D: It is not possible for an organization to implement information security in a consistent manner.