is incorrect. The scope change control system focuses on reviewing the actual changes to the project scope. When a change to the project's scope is proposed, the configuration management system is also invoked. Answer:A is incorrect. The cost change control system is responsible for reviewing and controlling changes to the project costs. Answer:D is incorrect. Integrated change control examines the affect of a proposed change on the project as a whole.

The best metric to verify adherence to the policy that requires critical security patches to be deployed in production within three weeks of patch availability is the maximum time gap between patch availability and deployment, as it measures the longest duration that the organization takes to apply the patches, and ensures that it does not exceed the policy limit. The other options are not the best metrics, as they may not reflect the actual or optimal compliance with the policy, or may not be relevant or measurable for the policy, respectively. References = CRISC Review Manual, 7th Edition, page 110.