The approval of an enterprise risk management framework is the role of the:

A. chief information officer.
B. chief risk officer.
C. IT steering committee
D. board of directors.