An IS auditor notes that several users have not logged into an application for more than one year. Which of the following would be the BEST audit recommendation? 

Answer options:

A. Periodically review the information security policy.
B. Update the termination procedures.
C. Periodically review user access.
D. Delete the affected users` IDs.

C