Which of the following BEST illustrates residual risk within an organization?

A. Risk management framework

B. Risk register

C. Business impact analysis

D. Heat map

Correct Answer: ??????????????????

______________________

Note

The official answer (could be incorrect because NO comes from ISACA!) is: "A. Risk management framework".

Other experts claim that the correct answer is: "B. Risk register".

Other experts claim that the correct answer is: "C. Business impact analysis".

Other experts claim that the correct answer is: "D. Heat map".

My point of view

At this link (https://www.examtopics.com/discussions/isaca/view/19646-exam-cism-topic-1-question-352-discussion/) there are some posts that are in line with my thought. In particular, I believe as "Runzing" and that is: "D. Heat Map. If it weren't for the keyword illustrate I'd say B. If the question was best place to record or document residual risk, absolutely B."

What is your point of view? Your expert opinion (and explanation) is strongly requested. Many thanks in advance.