When the inherent risk of a business activity is lower than the acceptable risk level, the BEST course of action would be to:

When the inherent risk of a business activity is lower than the acceptable risk level, the BEST course of action would be to:
A . implement controls to mitigate the risk.
B . monitor for business changes.
C . review the residual risk level
D . report compliance to management

Answer: B