Which of the following statements is true regarding internal control objectives of information systems?

A$.$ Primary responsibility of viable internal control rests with the internal audit division.

B$.$ A secure system may have inherent risks due to management's analysis of trade$-$offs identified by cost$-$benefit studies.

C$.$ Control objectives primarily emphasize output distribution issues.

D$.$ An entity's corporate culture is irrelevant to the objectives.