Senior management wants to promote investment in IT, but is uncertain that associated risks are being properly identified. The BEST way to address this concern is to:

Engaging an external consultant might help identify risk scenarios, but it's a one-time activity and doesn't establish an ongoing mechanism for continuous risk identification and integration with business strategy.

Appointing an IT representative to the business risk committee ensures that IT-related risks are identified, assessed, and discussed within the broader organizational risk management context, thereby addressing senior management's uncertainty directly. This integration facilitates a better understanding of IT's contribution to overall business risk and value.

Assigning an IT cost controller focuses on financial oversight, not the identification and management of IT-associated risks.

While IT should contribute to business cases, this focuses on justifying investments rather than proactively identifying and managing risks across the organization.