When of the following standard operating procedure (SOP) statements BEST illustrates appropriate risk register maintenance?

When risk is mitigated by third-party transfer (e.g., insurance), the risk itself isn't *removed*; rather, the responsibility and financial impact are shifted, and this change should be documented, not deleted.

When management accepts a risk, it means they acknowledge its existence and potential impact without further mitigation, and the risk still exists and should remain in the register with its acceptance status noted.

Risk register maintenance should reflect the dynamic nature of risks; therefore, removing risks only after a significant change in the environment, such as a major system overhaul or new threat landscape, ensures the register remains relevant and historically accurate. Mitigation, acceptance, or transfer typically changes the *status* or *level* of the risk but the event itself often remains a potential threat that should be documented and reviewed periodically, rather than outright removed.

While successful mitigation reduces residual risk, the original risk and its current state should still be tracked; removing it entirely would erase the history of the risk and the effort to mitigate it, which is valuable for future analysis and audits.