Which of The following BEST represents the desired risk posture for an organization?

Inherent risk is the risk level before any controls are applied; comparing it to risk tolerance is less relevant for a post-mitigation risk posture.

Operational risk being higher than risk tolerance indicates an unacceptable level of risk within operations, which is an undesirable posture.

Accepted risk higher than risk tolerance means the organization is accepting more risk than its predefined limit, indicating a poor and potentially non-compliant risk posture.

Residual risk is the level of risk remaining after all risk treatment and mitigation controls have been implemented. An organization's objective is to reduce and manage risks such that this remaining residual risk falls below the maximum level of risk it is willing to accept, known as risk tolerance.