To obtain evidence that user identification and password control procedures are functioning as designed, an auditor would most likely

a. Attempt to sign onto the system using invalid user identifications and passwords.

b. Write a computer program simulating the logic of the client’s access control software.

c. Extract a random sample of processed transactions, and ensure that the transactions were appropriately authorized.

d. Examine statements signed by employees stating that they have not divulged their user identifications and passwords to any other person.