An organization’s senior management decided to outsource the payroll function.

Reviewing the third-party risk assessment provides the broadest assurance that management considered the significant risks associated with outsourcing payroll before selecting a provider. Comprehensive due diligence should address financial viability, information security, privacy, regulatory compliance, business continuity, operational capability, reputation, control environment, subcontracting, and other relevant third-party exposures. Reviewing conduct and ethical values covers only one component of due diligence. Reviewing existing payroll operations evaluates the organization’s current process rather than the prospective service provider. Service-level agreement compliance would generally be evaluated after a provider has been selected and services are operating, making it unsuitable for the pre-selection stage. Because the question concerns whether management performed comprehensive evaluation before choosing a provider, reviewing the third-party risk assessment is the most appropriate internal audit engagement.