Which of the following BEST enables effective risk reporting to the board of directors?

Presenting case studies of breaches from other organizations might highlight general threats, but it does not directly articulate the specific risks and their impact on *this* organization's objectives.

Mapping risk scenarios to findings by internal audit is important for operational assurance, but it may not always align with the strategic language and concerns of the board.

The board of directors is primarily concerned with strategic direction, organizational performance, and shareholder value. By framing risk discussions in terms of their potential impact on corporate objectives and business value, reports become relevant, actionable, and align with the board's strategic oversight responsibilities, enabling informed decision-making.

Reporting key metrics on the efficiency and effectiveness of risk governance provides internal operational insight, but doesn't necessarily translate the *impact of risks* into the strategic context that the board requires.