When reporting information security risk to senior management, it is MOST important to include:

Control risk refers to the risk that a control fails to prevent or detect a misstatement, which is an input to assessing inherent and residual risk, but not the final picture for management.

Inherent risk is the risk before any controls are put in place, which is useful for initial assessment but doesn't reflect the current state for management decision-making.

Detection risk is the risk that an auditor will not detect a material misstatement, primarily relevant to audit processes rather than the ongoing operational risk reporting to management.

When reporting information security risk to senior management, it is most important to include residual risk because this figure represents the current level of risk remaining after all implemented controls have been considered. Senior management needs to understand the actual exposure and potential impact to the business that persists, enabling them to make informed decisions about further mitigation or risk acceptance.