You must enable IAM access audit logging in BigQuery for external auditors following Google best practices. What should you do?

To enable IAM access audit logging for external auditors in BigQuery, you should grant the auditors group the logging.viewer and bigquery.dataViewer predefined IAM roles. The logging.viewer role allows them to view audit logs, while the bigquery.dataViewer role provides read-only access to BigQuery datasets, which is necessary to understand the context of BigQuery-related audit entries. Assigning roles to a group is a best practice for managing access efficiently and scalably, rather than managing individual user accounts. Creating custom roles is generally unnecessary here, as predefined roles adequately cover the required permissions and are simpler to manage.