Which of the following is the MOST important factor when deciding on a control to mitigate risk exposure?

A. Comparison against best practice
B. Relevance to the business process
C. Regulatory compliance requirements
D. Cost-benefit analysis