A small company of 15 staff has one IT manager who configures and operates most controls. To satisfy clause 9.2's expectation of audit objectivity, which approach is most appropriate?

• A.Have a different competent person, an employee from another function or an external auditor, audit the IT manager's area so auditors do not audit their own work
• B.Have the IT manager audit the controls personally, with a review by the CEO so the report is signed off in time
• C.Skip the internal audit, since the certification body audit covers the same objective for a small company
• D.Ask the IT manager to complete a self-assessment, with the results filed so the certification body can sample them later