Which of the following would MOST likely result in updates to an IT risk appetite statement?

A. Changes in senior management
B. External audit findings
C. Feedback from focus groups
D. Self-assessment reports