The absence of a “right to audit” clause would potentially prevent the auditor from investigating any aspect of supplier performance moving forward, including control deficiencies, poor performance and adherence to legal requirements. This would be a major concern for the auditor since it would be difficult for the organization to assess whether the appropriate controls had been put in place. While a clear definition of penalty payment terms is desirable, not all contracts require the payment of penalties for poor performance and, when performance penalties are required, these penalties are often subject to negotiation on a case-by-case basis. As such, the absence of this information would not be as significant as choice A. Choice C is not correct because, while the inclusion of service level report templates would be desirable, as long as the requirement for service level reporting is included in the contract, the absence of predefined templates for reporting is not a significant concern. The absence of a limitation of liability clause for the service provider would, theoretically, expose the provider to unlimited liability. This would be to the advantage of the company so, while the IS auditor might highlight the absence of such a clause, it would not constitute a major concern. SOURCE?