Which of the following provides the MOST up-to-date information about the effectiveness of an organization's overall IT control environment?

A. Periodic penetration testing.
B. Key performance indicators (KPIs).
C. Internal audit findings.
D. Risk heat maps.