Which of the following is NOT true of risk management?

Group of answer choices

When risk is realized, it negatively affects an organization's profits.

Risk management helps an organization prioritize its information security practices according to the profitability of those practices.

Risk management makes sure that an organization spends its limited resources wisely and in ways that enhance business goals.

An organization uses risk management to plan and prioritize its information security activities.