Outsourcing the whistleblowing process is acceptable if proper controls are established to maintain confidentiality and effectiveness. IIA Standard 2600 requires auditors to monitor the implementation of recommendations and assess changes. Reviewing the third-party agreement ensures compliance with the original recommendation ' s intent. Insisting on an internal process (Option A) or escalating the issue (Option C) may not be necessary if outsourcing meets objectives. Taking no action (Option D) overlooks the auditor’s responsibility for follow-up.