The scanning will not degrade system performance. This is the most important consideration when establishing vulnerability scanning on critical IT infrastructure, because any degradation of system performance could affect the availability, reliability, and functionality of the IT services that depend on the infrastructure. Scanning during non-peak hours (A) could reduce the impact of scanning on system performance, but it does not guarantee that the scanning will not cause any degradation. Scanning followed by penetration testing (B) could provide more in-depth information about the vulnerabilities and their exploitability, but it does not address the potential impact of scanning on system performance. Scanning cost- effectiveness © is a relevant factor for choosing a scanning service or tool, but it is not as important as ensuring that the scanning will not compromise the system performance.
Reference: CISA Vulnerability Scanning, Description.

Assessing and tracking all compliance audit findings is the best way to support the effectiveness of a compliance program. This allows an organization to identify areas of non-compliance, take corrective action, and monitor improvements over time12. While implementing an awareness plan, using a governance, risk, and compliance (GRC) tool, and monitoring applicable regulations can contribute to a compliance program, they do not provide the same level of continuous improvement and effectiveness as assessing and tracking audit findings.

A database administrator (DBA) is responsible for maintaining the integrity, security and performance of the database systems. A DBA who is also responsible for developing and executing changes into the production environment may have a conflict of interest and pose a risk to the data quality and availability. Therefore, the IS auditor should first identify whether any compensating controls exist to mitigate this risk, such as independent reviews, approvals, audits or monitoring of the changes. Determining whether another DBA could make the changes, reporting a potential segregation of duties violation and ensuring a change management process is followed prior to implementation are possible actions that the auditor could take after identifying the compensating controls or the lack thereof. References:
* : Database Administrator (DBA) Definition
* : Segregation of Duties | ISACA
* : [Compensating Control Definition]