Which of the following is the MOST important topic to cover in a risk awareness training program for all staff?

A. The risk department’s roles and responsibilities.
B. Policy compliance requirements and exceptions process.
C. The organization’s information security risk profile.
D. Internal and external information security incidents.