Which of the following would be MOST helpful when justifying the funding required for a compensating control?

A. Business case
B. Risk analysis
C. Business impact analysis
D. Threat assessment