Which of the following is the GREATEST concern when using a generic set of IT risk scenarios for risk analysis?

A. Inherent risk might not be considered
B. Implementation costs might increase
C. Risk factors might not be relevant to the organization
D. Quantitative analysis might not be possible