If preventive controls cannot be implemented due to technology limitations, which of the following should be done FIRST to reduce risk?

A. Redefine the business process to reduce the risk
B. Evaluate alternative controls
C. Develop a plan to upgrade technology
D. Define a process for monitoring risk