Which statement best describes the purpose of control?

A. an ignored audit finding B. a missing password policy C. a safeguard that reduces likelihood or impact of risk D. an open admin panel