What would be an IS auditor’s BEST recommendation upon finding that a third-party IT service provider hosts the organization’s human resources (HR) system in a foreign country?

A. Conduct a privacy impact analysis.
B. Implement change management review.
C. Review third-party audit reports.
D. Perform background verification checks.