Which of the following is true regarding business process outsourcing?

a. Outsourcing a core, high-risk business process reduces the overall operational risks.

b. Outsourced processes should not be included in the internal audit universe.

c. The independent outside auditor is required to review all significant outsourced business processes.

d. Management's controls to ensure the outsourcing provider meets contractual performance requirements should be tested by the internal audit function.

I think it should be "D"