What role do the board and senior management risk committee play in cybersecurity governance from an internal audit perspective?

• A. They handle day-to-day security operations.
• B. They approve budgets only.
• C. They set governance, approve risk appetite and policies, oversee risk management, and rely on internal audit for independent assurance on cybersecurity controls and incident management.
• D. They are not involved in cybersecurity governance.

Answer: (C)