Which of the following would MOST likely result in updates to an IT risk profile?

A. Changes in senior management.
B. Establishment of a risk committee.
C. External audit findings.
D. Feedback from focus groups.