Q64
Single choice
Who should be responsible for approving the cost of controls to be implemented for mitigating risk?