which organizational position is directly responsible for the balancing of an organization's security risks with the costs to avoid them