Which of the following is the BEST course of action to reduce risk impact?

A. Create an IT security policy
B. Implement detective controls
C. Implement corrective measures
D. Leverage existing technology