With respect to the outsourcing of IT services, which of the following conditions should be of GREATEST
concern to an IS auditor?

A.
Outsourced activities are core and provide a differentiated advantage to the organization.

B.
Periodic renegotiation is specified in the outsourcing contract.

C.
The outsourcing contract fails to cover every action required by the arrangement.

D.
Similar activities are outsourced to more than one vendor.

Explanation:
An organization’s core activities generally should not be outsourced, because they are what the organization
does best; an IS auditor observing that should be concerned. An IS auditor should not be concerned about the
other conditions because specification of periodic renegotiation in the outsourcing contract is a best practice.
Outsourcing contracts cannot be expected to cover every action and detail expected of the parties involved,
while multisourcing is an acceptable way to reduce risk.