Which group is best suited to evaluate and report on the effectiveness of administrative controls an organization has put in place to a third party?

a. Internal auditors
b. Penetration testers
c. External auditors
d. Employees who design, implement, and monitor the controls