Risk management is MOST cost-effective:

A. when performed on a continuous basis.
B. while developing the business case for the security program.
C. at the beginning of security program development.
D. when integrated into other corporate assurance functions.