Which of the following is the BEST way to provide effective IT risk management?

A. Implementing a cost-effective mitigation program
B. Appointing a chief risk officer
C. Embedding risk management in operations
D. Establishing an incident management program