Which of the following would not be an appropriate step for an internal auditor to perform during an assessment of compliance with an organization's privacy pol...