Following an acquisition, the acquiring company's risk practitioner has been asked to update the organization's IT risk profile What is the MOST important information to review from the acquired…

Internal and external audit reports provide valuable findings, but the risk register and assessments offer a more consolidated and specific view of identified risks.

Risk disclosures in financial statements are typically high-level summaries and lack the granular IT risk detail required for an updated risk profile.

The acquired company's risk assessment reports and risk register provide a direct, comprehensive record of its identified IT threats, vulnerabilities, likelihoods, impacts, and existing controls. This detailed information is fundamental for understanding the acquired entity's current risk posture, integrating it into the acquiring company's overall IT risk profile, and identifying potential new or changed risks in the merged environment.

Business objectives and strategies provide context, but they do not directly detail the specific IT risks present within the acquired company's environment.