Which of the following elements is typically included in a security risk assessment report?

• A. Executive summary, scope, methodology, identified risks, likelihood/impact, recommended controls, residual risk, and action plan
• B. Detailed facility blueprints and vendor contact lists
• C. Employee performance evaluations
• D. Financial statements

Answer: (A)

At the heart of a security risk assessment report is presenting a clear, decision-ready picture of risk: what was examined, how risks were identified, how severe they could be, and what to do about them. Including an executive summary gives leadership a quick, high-level view; the scope defines the boundaries of the assessment; the methodology explains how risks were found and evaluated, lending credibility. Then the report lists identified risks with their likelihood and potential impact, which helps prioritize which risks demand attention first. Recommending controls shows practical steps to reduce risk, while noting residual risk reveals what remains after those controls are in place. An action plan ties it all together with concrete steps, owners, and timelines to drive implementation.

Other options don’t fit because they belong in different types of documents. Detailed facility blueprints and vendor contact lists are operational or security-planning materials, not the analytical, decision-focused core of a risk assessment report. Employee performance evaluations and financial statements address HR and financial performance, not risk identification and mitigation.