Upper management decides which risk to mitigate based on cost. This is an example of:

A.
qualitative risk assessment.

B.
business impact analysis.

C.
risk management framework.

D.
quantitative risk assessment.