A.IT risk management is separate from corporate risk management

B.Local managers are solely responsible for risk evaluation

C.Risk evaluation is embedded in management processes.

D.Risk management strategy is approved by the audit committee