Which of the following BEST illustrates residual risk within an organization?

A balanced scorecard is a strategic performance management tool, not primarily a risk illustration tool.

A risk management framework is a structured approach to managing risk, not a direct illustration of residual risk itself.

A business impact analysis (BIA) identifies critical business functions and their impact if disrupted, but it doesn't directly illustrate residual risk after controls are applied.

A heat map visually represents risks, typically plotting likelihood against impact, and can effectively display residual risk by showing the remaining risk levels after controls and mitigation strategies have been implemented. It provides a clear, concise overview of the organization's current risk posture.