An internal auditor is conducting an initial risk assessment of an audit area and wants to assess management's compliance with privacy laws for safeguarding customer information stored on the organization's servers. Which course of action is appropriate for this phase of the engagement? A. Solicit the services of a specialist information systems auditor B. Obtain the most current approved copies of the organization's privacy policy C. Consult with legal counsel about new privacy laws to establish appropriate criteria D. Consider the detection risk of noncompliance with the laws