A new software package that could help mitigate risk in an organization has become available.

When evaluating new technology or tools for risk mitigation, the practitioner must ensure that the benefits justify the cost.

CRISC states:

“Risk practitioners should perform a cost-benefit analysis to determine the feasibility and value of implementing new controls or technologies.”

Governance or best practices are general references.

The cost-benefit analysis directly supports decision-making and accountability.

Hence, D is correct.

CRISC Reference: Domain 3 – Risk Response and Mitigation, Topic: Control Selection and Cost-Effectiveness.