Which outcome is expected from effective organizational security?

A. sharing passwords publicly B. bypassing management approval C. ignoring risks and controls D. assigning roles, duties, and governance responsibilities