Which of the following is MOST useful when communicating risk to management?