As a best practice, risk assessments should be based upon which of the following?

A.
A qualitative measurement of risk and impact

B.
A survey of annual loss, potential threats and asset value

C.
A quantitative measurement of risk, impact and asset value

D.
An absolute measurement of threats