Which of the following should be included in a risk scenario to be used for risk analysis?

A. Residual risk
B. Risk tolerance
C. Risk appetite
D. Threat type