An organization's business gap analysis reveals the need for a robust IT risk strategy. Which of the following should be the risk practitioner's PRIMARY consideration when participating in development

The scale of technology is a factor in identifying specific risks and controls, but less foundational than the overall risk culture for strategy development.

Risk indicators are tools for monitoring risk, which come *after* the strategy defines what to monitor and why.

Risk culture encompasses the shared attitudes, values, and practices that characterize how an organization perceives and responds to risk. A strategy, no matter how robust, will fail if it's not aligned with or doesn't seek to influence the underlying culture regarding risk-taking and compliance.

The proposed risk budget is an important resource constraint, but the strategy needs to align with the organization's willingness and ability to manage risk, which is shaped by culture.