Which of the following BEST balances the costs and benefits of managing IT risk*?

Prioritizing and addressing risk in line with risk appetite ensures that resources are optimally allocated to manage risks that exceed acceptable levels, preventing over- or under-investment in risk mitigation. This approach directly links risk management activities to the organization's strategic tolerance for risk, thus balancing expenditure with protection.

Eliminating all risk is generally impractical and cost-prohibitive, making it an unsustainable approach for balancing costs and benefits.

Considering risk sharing is a specific risk response strategy and does not, by itself, represent the overall balance of costs and benefits for managing all IT risk.

Evaluating the probability and impact of risk scenarios is a critical step in risk assessment, but it is preparatory to decision-making and does not inherently balance the costs and benefits of risk management itself.