With respect to the outsourcing of IT services, which of the following conditions should be of
GREATEST concern to an IS auditor?

A.
Outsourced activities are core and provide a differentiated advantage to the organization.

B.
Periodic renegotiation is specified in the outsourcing contract.

C.
The outsourcing contract fails to cover every action required by the arrangement.

D.
Similar activities are outsourced to more than one vendor.

Explanation:

An organization’s core activities generally should not be outsourced, because they are what the
organization does best; an IS auditor observing that should be concerned. An IS auditor should
not be concerned about the other conditions because specification of periodic renegotiation in the
outsourcing contract is a best practice. Outsourcing contracts cannot be expected to cover every
action and detail expected of the parties involved, while multisourcing is an acceptable way to
reduce risk.