Which of the following is the MOST effective way to communicate information security risk to senior management?

A. Business impact analysis
B. Balanced scorecard
C. Key performance indicators (KPIs)
D. Heat map