Which of the following is MOST helpful to management in determining whether risks are within an organization’s tolerance level?

A. Audit findings
B. Heat map
C. Penetration test results
D. Maturity level