While performing an operational audit of the firm's production cycle, an internal auditor discovers that, in the absence of specific guidelines, some engineers and buyers routinely accept vacation trips paid by certain of the firm's vendors. Other engineers and buyers will not accept even a working lunch paid for by a vendor. Which of the following actions should the internal auditor take?

A. None. The engineers and buyers areprofessionals. It is inappropriate for an internal auditor to interfere in what is essentially a personal decision.

B. Informally counsel the engineers and buyers who accept the vacation trips. This helps prevent the possibility of kickbacks, while preserving good auditor-auditee relations.

C. Issue a formal deficiency report naming the personnel who accept vacations but make no recommendations. Corrective action is the responsibility of management.

D. Formally recommend that the organization establish a corporate code of ethics. Guidelines of acceptable conduct, within which individual decisions may be made, should be provided.