Which of the following would MOST likely result in updates to an IT risk profile?