Which approach is CORRECT when applying the guiding principle 'keep it simple and practical'?


A. Only add controls and metrics when they are needed
B. Design controls and metrics first, then remove those not adding value
C. Design controls and metrics and add them individually until all are implemented
D. Only add controls and metrics that are required for compliance