Which of the following should the company do to address the residual risk?

A company has completed the implementation of technical and management controls as required by its adopted security, ponies and standards. The implementation took two years and consumed s the budget approved to security projects. The board has denied any further requests for additional budget.

Which of the following should the company do to address the residual risk?
A . Transfer the risk
B . Baseline the risk.
C . Accept the risk
D . Remove the risk

Answer: C