Which of the following is the BEST way to identify changes to the risk landscape?

A. Access reviews
B. Root cause analysis
C. Internal audit reports
D. Threat modeling