Which of the following is MOST important for an information security manager to communicate to senior management regarding the security program?

A. Potential risks and exposures
B. Impact analysis results
C. Security architecture changes
D. User roles and responsibilities