Which of the following is the BEST approach for obtaining management buy-in to implement additional IT controls?

While referencing IT risk management frameworks is good practice, it may not resonate directly with management who need to see the business value or impact.

Providing information on GRC platform functionalities focuses on tools and technology rather further than the business impact or the problem that needs solving for management.

Management, especially senior leadership, primarily operates on a financial basis and understands the language of money. Translating IT risks into potential monetary losses (e.g., lost revenue, regulatory fines, recovery costs) clearly demonstrates the business impact, making the need for additional controls tangible and justifiable from a financial perspective.

Presenting new KRIs based on industry benchmarks can be informative, but without translating these indicators into their potential monetary impact on the organization, their urgency and relevance for management buy-in may be limited.