In order to master risks and controls and how they fit together, which of the following is NOT one of the areas to fully understand? A. The type and nature of risks in IT systems. B. The description of the general and application controls that should exist in IT system. C. The accounting information system. D. The recognition of how controls can be used to reduce risk