Which approach is CORRECT when applying the guiding principle ‘keep it simple and practical’?

Only add controls and metrics when they are needed

Design controls and metrics first, then remove those not adding value

Design controls and metrics and add them individually until all are implemented

Only add controls and metrics that are required for compliance