A. To identify potential areas of non-compliance with internal policies.

B. To assess the financial institution's exposure to various types of risks.

C. To allocate resources for regulatory compliance efforts.

D. To generate revenue through risk management activities.