Which of the following would be MOST helpful in developing a corrective action plan in response to a risk finding?

a. Business impact analysis (BIA)
b. Gap analysis
c. Threat analysis
d. Root cause analysis