Senior management wants to promote investment in IT, but is uncertain that associated risks are being properly identified. The BEST way to address this concern is to:

A. ensure business cases are developed by IT.
B. engage an external consultant to develop risk scenarios.
C. assign an IT cost controller to the finance department.
D. appoint an IT representative to the business risk committee.