In addition to the legal and regulatory requirements for risk management, what are two other sources of requirements for risk management programs within an organization?
A. Contractual requirements
B. Risk assessor requirements
C. Industry association requirements
D. Activist group requirements