Before implementing controls, management should FIRST ensure that the controls:

A.
satisfy a requirement in addressing a risk issue.

B.
do not reduce productivity.

C.
are based on a cost-benefit analysis.

D.
are detective or corrective.

Explanation:
When designing controls, it is necessary to consider all the above aspects. In an ideal situation, controls that
address all these aspects would be the best controls. Realistically, it may not be possible to design them all and
cost may be prohibitive; therefore, it is necessary to first consider the preventive controls that attack the cause
of a threat.