An Auditor Is Scheduled to Audit Payroll Controls for a Company

An auditor is scheduled to audit payroll controls for a company which has recently outsourced its processing to an information service bureau. What action should the auditor take, considering the outsourcing decision?

A) Review the controls over payroll in both the company and the service bureau.
B) Review only the company's controls over data sent to and received from the service bureau.
C) Review only the controls over payments to the service bureau based on the contract.
D) Cancel the engagement because the processing is being performed outside of the organization.