Which of the following would be MOST helpful to an information security management team when allocating resources to mitigate exposures? 

Answer options:

A. Internal audit findings
B. Relevant risk case studies
C. Risk assessment results
D. Penetration testing results

C