How does a risk analysis show management how much money to spend per security measure?

A.
It shows management how much could be lost if the security measure is not implemented.

B.
It calculates the frequency of the risk multiplied by the cost/benefit ratio of the ALE.

C.
It shows management how much money could be saved if the security program was implemented.

D.
It provides the qualitative severity of the security measure.

Explanation:
The crux of carrying out a risk analysis is to calculate risk and
estimate how much specific threats could cost the company. From these numbers and
information, management can make a decision on the best security mechanisms and how
much should be spent on them.