f risk has been identified, but not yet mitigated, the enterprise would: Question 43 options: A) obtain management commitment to mitigate all identified risk within a reasonable time frame. B) document identified risk in the risk register and maintain the remediation status C) conduct an annual risk assessment, but disregard previous assessments to prevent risk bias