Which of the following is the MOST useful information to include in a risk report...

The most useful information to include in a risk report regarding control effectiveness is whether the controls are functioning as intended to reduce risk to acceptable levels. This directly addresses the core purpose of controls.

While alignment with standards (B) is important, it doesn't guarantee effectiveness. Confirmation of deficiencies by external audits (C) is relevant, but the primary focus is on whether controls are working.