Which of the following resources is MOST helpful to a risk practitioner when updating the likelihood rating in the risk register?

A risk control assessment evaluates the effectiveness of existing controls but does not directly provide updated data on the likelihood of a threat occurring.

Audit reports with risk ratings typically summarize findings and existing risk levels, but penetration test results offer a more specific, current, and actionable assessment of the likelihood of exploit.

Penetration test results provide real-world evidence of exploitable vulnerabilities within an organization's systems, demonstrating how likely a threat agent could successfully compromise a system or data. This direct validation of potential attack paths significantly informs and updates the likelihood rating of associated risks.

A Business Impact Analysis (BIA) determines the impact of a disruption, not the likelihood of a disruptive event occurring.