A major risk when upgrading an IT network after a ransomware incident is that new access controls, monitoring rules, security procedures, or user restrictions may be perceived as burdensome by employees. If users believe the new processes slow work or are overly restrictive, they may bypass controls, resist implementation, or fail to comply consistently. Option A relates to project governance, but the scenario focuses on operational and user impact of the network change. Option B is not a risk created by the change itself. Option D describes service-quality consequences but is less directly tied to the policy and control changes introduced after ransomware. Internal audit should review change management, user communication, training, access redesign, and control adoption. Therefore, Option C is correct.