Which of the following is MOST important to include when reporting the effectiveness of risk management to senior management?

Changes in risk appetite and tolerance are strategic decisions set by senior management, not typically reported *to* them as a measure of risk management *effectiveness*.

Impact due to changes in risk factors is important for risk identification and assessment, but the effectiveness of risk management is measured by how well those risks are controlled, reflected in residual risk.

Senior management is primarily concerned with whether the organization's current risk exposure (residual risk) aligns with its defined risk appetite and tolerance levels, as this directly indicates if risk management efforts are effectively bringing risks within acceptable boundaries.

While benchmarking against industry best practices can be valuable, it is an input for improvement, not the primary metric for reporting the overall *effectiveness* of an organization's specific risk management program to senior management.