The security policy should have been carried out, but it wasn’t. That’s the fault of the management.

A  It’s not the fault of  the management if the security policy  has not been  carried out.

B  That the security policy has not been carried out is the fault of the management  

C  The fault of the management is that they have carried out the security policy.

D The management has carried out the security policy, but it turned out to be a fault.