Which of the following is the PRIMARY reason for a risk practitioner to report changes and trends in the IT risk profile to senior management?

While risk owners need to understand their responsibilities, reporting to senior management serves the higher-level strategic governance function of overall risk oversight, not merely individual owner understanding.

Senior management bears the ultimate responsibility for defining the organization's risk appetite and ensuring that all risks, including IT risks, remain within these established acceptable limits. Reporting IT risk changes and trends enables senior management to monitor compliance with the risk appetite, make informed decisions regarding risk treatment strategies, and allocate resources effectively to maintain the desired risk posture.

Ensuring compliance with legal requirements is a critical aspect of risk management, but it falls under the broader objective of keeping risk within the acceptable organizational limits.

Ensuring the effectiveness of an IT risk awareness program is an operational detail that supports risk management, not the primary strategic reason for senior management risk reporting.