Which of the following should an IS auditor review to determine user permissions that have been granted for a particular resource?

A. Systems logs
B. Access control lists (ACL)
C. Application logs
D. Error logs