Isaca IT Risk Fundamentals Exam - Topic 6 Question 26 Discussion

Detailed risk management reports should be targeted based on the 'need to know' principle. This means providing information only to those who need it to fulfill their roles and responsibilities. This helps ensure that information is relevant and actionable.

Industry benchmarks (B) can inform reporting, but the audience's needs are paramount. Seniority levels (C) can be a factor, but the specific need for the information is more important.