What should a risk practitioner do NEXT if an ineffective key control is identified on a critical system?
A . Revalidate the risk assessment.
B . Escalate to senior management.
C . Propose acceptance of the risk.
D . Conduct a gap analysis.
Answer: D