After the implementation of internal of Things (IoT) devices, new risk scenarios were identified. What is the PRIMARY reason to report this information to risk owners?

Reevaluating continued use of IoT devices might be a *consequence* of confirming the risk profile impact, but it's not the primary reason for initially reporting the identified new risks.

Adding new controls is a potential *response* to the identified risks after their impact on the risk profile has been understood and accepted or deemed unacceptable.

Recommending changes to the IoT policy is a specific action that might follow the assessment of new risks, not the primary reason for the initial report to risk owners.

Reporting newly identified risk scenarios to risk owners primarily serves to confirm the impact these new risks have on the organization's overall risk profile. Risk owners need to understand how their existing risk landscape has changed and if the new risks fall within their acceptable risk appetite, enabling them to make informed decisions about necessary adjustments or treatments.