Whose risk tolerance matters MOST when making a risk decision?

A. Customers who would be affected by a breach
B. The information security manager
C. The business process owner of the exposed assets
D. Auditors, regulators, and standards organizations