Adequate action taken for noncompliance with the service level agreement (SLA) provides the best evidence that outsourced provider services are being properly managed. This shows that the organization is monitoring the performance of the provider and enforcing the terms of the SLA.
The other options are not as convincing as evidence of proper management. Option A, the SLA includes penalties for non-performance, is a good practice but does not guarantee that the penalties are actually applied or that the performance is satisfactory. Option C, the vendor provides historical data to demonstrate its performance, is not reliable because the data may be biased or inaccurate. Option D, internal performance standards align with corporate strategy, is irrelevant to the question of outsourced provider management.
References:
* ISACA, CISA Review Manual, 27th Edition, 2019, page 2821
* ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription, QID
1066692

While all the options can help reduce the risk of data leakage, providing education and guidelines to employees on the use of social networking sites would be the most effective. This is because it directly addresses the issue at hand - the use of social networking sites for business purposes1. Education and guidelines can help employees understand the risks associated with social media use and teach them how to safely and responsibly use these platforms for business purposes1. This includes understanding privacy settings, recognizing phishing attempts, and knowing what information should not be shared on these platforms1.
References:
10 Social Media Guidelines for Employees in 2023 - Hootsuite

Segregation of duties is a key internal control that aims to prevent fraud and errors by ensuring that no single individual has the authority to execute two or more conflicting sensitive transactions or functions. In the accounts payable vendor payment cycle, segregation of duties involves separating the tasks of vendor setup, procurement, invoice approval, and payment processing1. This way, an employee cannot create a fictitious vendor and issue a payment to themselves or their accomplices without being detected by another person. Therefore, the best way to prevent fraudulent payments is to implement segregation of duties between the vendor setup and payment processing. References: 1: Segregation of Duties in the Accounts Payable Vendor Payment Cycle for SMBs - Now With a Podcast! - Debra R Richardson : What is Separation of duties
- University of California, Berkeley