To effectively support business decisions, an IT risk register MUST:

A. reflect the results of risk assessments.
B. effectively support a business maturity model.
C. be available to operational risk groups.
D. be reviewed by the IT steering committee.