To reduce an organization’s risk exposure by verifying compliance with company policy, which of
the following should be performed periodically?

A.
Qualitative analysis

B.
Quantitative analysis

C.
Routine audits

D.
Incident management