Which of the following is the BEST outcome measure to determine the effectiveness of IT risk management processes?

A. Time lag between when IT risk is identified and the enterprise's response
B. Percentage of business users satisfied with the quality of risk training
C. Frequency of updates to the IT risk register
D. Number of events impacting business processes due to delays in responding to risks