A risk management team is in the middle of one of their quarterly review meetings and a debate ignites about why security controls exist at all. Which of the following arguments is true?

A.
Controls exist to eliminate risk and eliminate loss.

B.
Controls exist to eliminate risk and reduce loss.

C.
Controls exist to identify risk and reduce loss.

D.
Controls exist to mitigate risk and reduce loss.

Explanation:
Understanding why security controls are used is a critical factor for risk
management teams to truly comprehend. Risk cannot be eliminated nor can loss. It can
mitigated, though, and when done correctly, loss can be reduced.