Which of the following actions by an organization best reflects the idea of residual risk?

An organization pursues an acquisition despite the risk associated with the transaction.

An organization faces risk associated with its raw materials supply and chooses to continue to use only one supplier.

An organization assesses the risk associated with a material misstatement in a specific account on the financial statements and puts controls in place to mitigate the risk but cannot eliminate the risk entirely.

An organization assesses external and internal threats that could impact its ability to achieve its business objectives.