Which of the following concepts recognizes that managers must use their judgment to ensure that the cost of control does not exceed the system's benefits or the risks involved?
a) risk assessment
b) reasonable assurance
c) security policy
d) security versus privacy