An organization has implemented several risk mitigation strategies to reduce and identified risk. The risk control measures are sufficient when:

	A.	risk avoidance is justified by cost benefit analysis
	B.	the residual risk is less than or equal to the risk acceptance level
	C.	the risk acceptance level is less than or equal to the total risk level
	D.	risk mitigation is equal to annual loss expectancy