Which of the following would be the MOST important information to include in a business case for an information security project in a highly regulated industry?

A. Industry comparison analysis
B. Critical audit findings
C. Compliance risk assessment
D. Number of reported security incidents