Which of the following is the BEST approach to use when creating a comprehensive set of IT risk scenarios?

A. Gather scenarios from senior management
B. Derive scenarios from IT risk policies and standards
C. Benchmark scenarios against industry peers
D. Map scenarios to a recognized risk management framework