White box testing leverages full access to the application's source code and internal architecture, enabling testers to systematically uncover hidden logic errors, security flaws, and inefficiencies and to recommend code-level optimizations.

The most important step in a privacy audit is to ensure that all risks associated with PII handling are identified. This requires analyzing the entire PII data life cycle--from collection, processing, storage, and transfer to retention and destruction.
Option A: Reviewing data management controls is part of the audit but is narrower than life cycle coverage.
Option B: Privacy training is necessary, but training alone doesn't ensure compliance.
Option C: Reviewing third-party agreements is important but only covers outsourced risks.
Option D: Provides comprehensive coverage of privacy risks across all stages.

The IS auditor's best course of action is to review backup logs to confirm whether backups are executed on schedule and completed successfully. This provides objective evidence of whether manual initiation during peak usage affects backup performance, data integrity, or recovery capability.