When the inherent risk of a business activity is lower than the acceptable risk level, the BEST course of action would be to:

A. monitor for business changes

B. review the residual risk level

C. report compliance to management

D. implement controls to mitigate the risk