Residual risk is the risk that remains after controls have been implemented. If this residual risk is within the enterprise's risk appetite, it can be accepted. This means acknowledging the risk and not taking further action to mitigate it. The risk should be documented and updated in the risk register to maintain a record of accepted risks.
Mitigating through additional controls (B) is unnecessary if the risk is already within appetite. Transferring to a third party (C) is another risk response, but not necessary in this case.