An IS auditor has learned that access privileges are not periodically reviewed or updated Which of the following would provide the BEST evidence to determine whether transactions have been executed by authorized employees? Audit trails Control totals Reconciliations Change logs