Which of the following would help management determine the resources needed to mitigate a risk
to the organization?

A.
Risk analysis process

B.
Business impact analysis (BIA)

C.
Risk management balanced scorecard

D.
Risk-based audit program

Explanation:

The business impact analysis (BIA) determines the possible outcome of a risk and is essential to
determine the appropriate cost of control. The risk analysis process provides comprehensive data,
but does not determine definite resources to mitigate the risk as does the BIA. The risk
management balanced scorecard is a measuring tool for goal attainment. A risk-based audit
program is used to focus the audit process on the areas of greatest importance to the
organization.