During an Audit of a Contract for Computer Security, a Governmental

Multiple Choice

During an audit of a contract for computer security, a governmental auditor finds that a contractor has developed a system that could be the most advanced in the industry. If it seems that the contractor is charging the government for developmental cost of a system that might be sold to other organizations, what is the auditor's best course of action?

A) Estimate the cost to develop the advanced security system and inform the contractor that it will be a disallowed cost.
B) Exclude the observation from the engagement final communication because the contract was vague and the level of security is clearly acceptable.
C) Estimate the added cost, report it to management, and suggest that management meet with its lawyers and the contractor to resolve differences.
D) Compare the cost of the security program with previous costs incurred by governmental operations and inform the contractor that the difference will be a disallowed cost.