An internal auditor developed a list of internal and external risk considerations across the organization's processes, developed a scale to assess each risk and allocated the relative importance of each risk. When of the following approaches did the auditor take? 

A. Top-down approach 

B. Process-Metrix approach 

C. Risk-factor approach 

D. Bottom up approach