Following an IS audit, which of the following types of risk would be MOST critical to communicate to key stakeholders?