Which statement is most appropriate?

a. One basic approach that has been discussed is risk-based systems auditing. This involves establishing the system objectives, finding out what risks should be addressed and then developing appropriate solutions to minimize all risks.

b. One basic approach that has been discussed is risk-based systems auditing. This involves establishing the system controls, finding out what risks should be addressed and then developing appropriate solutions to mitigate unacceptable levels of risk.

c. One basic approach that has been discussed is control-based systems auditing. This involves establishing the system objectives, finding out what risks should be addressed and then developing appropriate solutions to mitigate unacceptable levels of risk.

d. One basic approach that has been discussed is risk-based systems auditing. This involves establishing the system objectives, finding out what risks should be addressed and then developing appropriate solutions to mitigate unacceptable levels of risk.