Which of the following is the BEST method to maintain a common view of IT risk within an organization?

Collecting data for IT risk assessment is a foundational step, but merely collecting data doesn't ensure a common *view* of the risk; the data needs to be analyzed and synthesized.

Establishing and communicating a clear IT risk profile provides a consolidated, high-level understanding of the organization's key IT risks, their likelihood, impact, and current mitigation status. This consistent view ensures that all stakeholders, from technical teams to senior management, share a common understanding of IT risk, facilitating informed decision-making and alignment across the organization.

Utilizing a balanced scorecard is a performance management tool that can incorporate risk metrics, but it's not as direct or comprehensive for establishing a common *view* of the entire IT risk landscape as a dedicated risk profile.

Performing and publishing an IT risk analysis provides detailed insights, but without synthesizing this into a concise, communicated risk profile, it may not effectively create a *common* understanding among diverse stakeholders.