Which of the following is most likely to be a difficulty when using a controls matrix to evaluate whether the most cost-effective set of controls has been used in an internal control system?

a. Not all types of exposures and not all types of control objectives can be evaluated using a controls matrix

b. A control matrix focuses only on costs and not benefits, and it focuses only on the operational and maintenance costs associated with controls

c. Choosing values for the elements of the matrix might be difficult because the costs of a particular control might depend on what controls are in place already

d. The order in which controls should be listed in the rows and exposures should be listed in the columns might not be clear until the benefits of the controls have been assessed