Regarding the engagement observation concerning an advanced computing security system, what is the most appropriate course of action by the internal auditor?
A) Estimate the added cost, report it to management, and suggest that management meet with its lawyers and the outsourcer to resolve differences.
B) Exclude the observation from the engagement communication because the contract was vague and the level of security is clearly acceptable.
C) Compare the cost with previous costs incurred by governmental operations and inform the outsourcer that the difference will be a disallowed cost.
D) Estimate the amount of cost used to develop the advanced security system and inform the outsourcer that it will be a disallowed cost.