Senior management has made a decision to automate a number of key controls due to concerns that current IT risk controls are overly cumbersome and adversely impacting IT agility. Which of the following should be required FIRST to facilitate this process?

A. Control gap analysis
B. Control self-assessments
C. Controls optimization
D. Cost-benefit analysis