An IS auditor evaluating logical access controls should FIRST: 
A、document the controls applied to the potential access paths to the system. 
B、test controls over the access paths to determine if they are functional. 
C、evaluate the security environment in relation to written policies and practices. 
D、obtain an understanding of the security risks to information processing.