Which of the following is the BEST way for a risk practitioner to present an annual risk management update to the board?

A summary of risk response plans and validation results is too detailed and operational for a board-level overview; it's better suited for risk management teams.

A report with control environment assessment results focuses on specific controls, which is generally too granular for the board's strategic oversight role.

Boards require high-level, strategic information that allows them to quickly grasp the organization's risk posture and make informed decisions. A dashboard summarizing Key Risk Indicators (KRIs) provides a concise, visual representation of critical risks, trends, and performance against risk appetite, making it highly effective for executive-level communication.

A summary of IT risk scenarios with business cases, while important, often goes into too much technical detail for an annual board update, which typically requires a broader, integrated view of enterprise risk.