IT risk assessments can BEST be used by management:

A. to measure organizational success.
B. as input for decision-making.
C. as a basis for cost-benefit analysis.
D. for compliance with laws and regulations.