Which ONE of the following statements about the benefits of getting risk and control assessment right is INCORRECT?

A. Comprehensive and consistent information about the level of risk in the firm is essential to ensure that the board and senior management make informed business decisions.

B. Risk and control assessments are a simple way of getting the benefits of operational risk management early.

C. Risk and control assessments enable you to identify potential risk hotspots and control bottlenecks quickly.

D. An agreed methodology of risk and control assessment can be used as a form of back-testing operational risk exposure, for instance by identifying data gaps in risk and control assessments.