Which of the following is MOST important for an information security manager to regularly report to senior management?

A. Results of penetration tests
B. Audit reports
C. Impact of unremediated risks
D. Threat analysis reports