Who Has the Primary Responsibility for Establishing and Maintaining Controls

Who has the primary responsibility for establishing and maintaining controls?

A) Primary responsibility for controls belongs to internal auditors. They are the ones who create the controls and investigate potential violations of the controls.
B) Primary responsibility rests with management. Management both conveys acceptable culture and has the final say in how fraud cases are treated.
C) Primary responsibility lies with employees. They are the ones most likely to witness violations and are responsible to watch for those violations.
D) Primary responsibility is not attributable to one person or group of people within an organization. Each member of an organization must consider himself or herself personally responsible for the organizations control environment.