All of the following are true of measuring the effectiveness of security policies, except: A. you can get a basic understanding if individuals are being held accountable for adherence to security policies by examining policy violations, incidents, and security awareness. B. measuring accountability is easier than measuring effectiveness. C. the best measurement of whether employees are following policies is the actual reduction in risk that occurs. D. to ensure accountability, you need to measure if employees are following the policies.