Which approach is CORRECT when applying the guiding principle ‘keep it simple and practical’?
Only add controls and metrics when they are needed
Design controls and metrics first, then remove those not adding value
Design controls and metrics and add them individually until all are implemented
Only add controls and metrics that are required for compliance
Submit