IT stakeholders have asked a risk practitioner for IT risk profile reports associated with specific departments to allocate resources for risk mitigation. The BEST way to address this request would be to use:

A. historical risk assessments
B. key risk indicators (KRIs)
C. the cost associated with each control
D. information from the risk register