Which of the following should be reported periodically to the risk committee?

A system risk and control matrix is an operational document useful for management and auditors but typically too detailed for periodic reporting to a strategic risk committee.

Emerging IT risk scenarios, such as new threats, technologies, or regulatory changes, can significantly alter an organization's overall risk profile. The risk committee requires this information to make informed strategic decisions, allocate resources, and adjust risk appetite or mitigation strategies proactively.

Changes to the risk assessment methodology are important for consistent risk evaluation but are usually reported when the change occurs, not necessarily on a periodic basis once implemented.

The audit committee charter defines the scope and responsibilities of the audit committee and is not typically a periodic report to the risk committee.