Corporate governance establishes a framework of rules and practices to ensure accountability, fairness, and transparency in an organization's dealings with shareholders and other stakeholders. This includes oversight of the organization's strategic direction, risk management, and performance. Internal audit (A) and risk oversight (C) are components of governance, while key performance indicators (D) are metrics used for tracking objectives.
Reference: https://www.igi-global.com/dictionary/corporate-governance/5957

Scope creep occurs when the scope of a project expands uncontrollably due to changing customer or user requirements without corresponding adjustments to time, resources, and budget. This phenomenon leads to escalating costs and delays, as new requirements often require additional resources or changes to existing plans. It is distinct from cost-benefit adjustments or prototype issues, which are planned adjustments, and expectations management, which deals with aligning stakeholder expectations.
Reference:
http://www.umsl.edu/~sauterv/analysis/6840_f03_papers/gurlen/
Reference:
http://www.umsl.edu/~sauterv/analysis/6840_f03_papers/gurlen/

Prerequisites for Risk Calculation:
* Asset valuation is necessary to quantify the potential impact of risks.
* It provides the basis for assessing risk severity and prioritization.
Why This is Correct:
* Without assigning value, it is impossible to calculate financial impacts or prioritize risks.
Why Other Options Are Incorrect:
* A. Likelihood of attacks: Part of the calculation, not a prerequisite.
* B. Calculating risks: Comes after valuation.
* D. Relative risk assessment: Requires valuation as input.
References:
EC-Council highlights the importance of asset valuation as the first step in effective risk assessment and calculation.

ECCouncil 712-50 : Practice Test