Which of the following is the BEST way to ensure adequate resources will be allocated to manage identified risk?

After a high-profile systems breach at an organization s key vendor, the vendor has implemented additional mitigating controls. The vendor has voluntarily shared the following set of assessments:
Which of the assessments provides the MOST reliable input to evaluate residual risk in the vendor's control environment?

Which of the following would BEST help an enterprise define and communicate its risk appetite?

The PRIMARY reason a risk practitioner would be interested in an internal audit report is to: