A bank wants to outsource a system to a cloud provider residing in another country. Which of the following would be the MOST appropriate IS audit recommendation?

While finding an alternative provider in the home country might simplify some legal aspects, it's not always feasible or the most appropriate recommendation for auditing an existing outsourcing plan; the audit should focus on mitigating risks if the plan proceeds.

This statement is incorrect; a provider is primarily subject to the laws of its own country and, via contract, specific aspects of the client's country laws, but not automatically all laws, making legal and regulatory compliance a major risk that requires specific due diligence.

Ensuring disaster recovery capability is a critical component of a provider's internal control system and overall resiliency, but it's not as comprehensive as evaluating the entire internal control system against all bank requirements (which would include security, data privacy, operational controls, etc.).

Outsourcing to a foreign provider introduces complex regulatory, legal, and operational risks. Ensuring the provider's internal control system meets the bank's requirements is paramount because it directly addresses the bank's ongoing obligations for data protection, financial reporting integrity, regulatory compliance, and overall operational security, effectively extending the bank's control framework to the outsourced environment.