Which of the following BEST supports the prioritization of new IT projects?

A.
Internal control self-assessment (CSA)

B.
Information systems audit

C.
Investment portfolio analysis

D.
Business risk assessment

Explanation:
It is most desirable to conduct an investment portfolio analysis, which will present not only a clear
focus on investment strategy, but will provide the rationale for terminating nonperforming IT projects.
Internal control self-assessment {CSA} may highlight noncompliance to the current policy, but may
not necessarily be the best source for driving the prioritization of IT projects. Like internal CSA, IS
audits may provide only part of the picture for the prioritization of IT projects. Businessrisk analysis
is part of the investment portfolio analysis but, by itself, is not the best method for prioritizing new
IT projects.