Mary has been tasked with preliminary planning for a security program. Which of the following would not be within her task scope?

A.
Articulate security mission objectives

B.
Determine roles and responsibilities

C.
Establish the security audit function

D.
Evaluate risks and benefits

Explanation:
Establishing an audit function represents an activity that the
security program might initiate. But first, the program must be established.