While preparing for a third-party audit, the vice president of risk management and the vice presi

dent of information technology have stipulated that the vendor may not use offensive software during the audit. This is an example of:

A. organizational control.

B. service-level agreement.

C. rules of engagement.

D. risk appetite.