Risk mitigation is MOST effective when which of the following is optimized?

Operational risk is a type of inherent risk, and while mitigation addresses it, the overall goal of mitigation applies to the resultant risk, which is residual risk.

Risk mitigation involves implementing controls to reduce inherent risk. The goal is to reduce the risk to an acceptable level, which is known as the residual risk. Optimizing residual risk means ensuring that the remaining risk is as low as reasonably practicable (ALARP) or within the organization's risk appetite, striking a balance between the cost of controls and the potential impact of the risk.

Inherent risk is the risk level before any controls are applied; mitigation aims to reduce inherent risk, but the effectiveness is measured by how well the residual risk is managed.

Regulatory risk is a specific category of risk, and like operational risk, its mitigation contributes to reducing inherent risk, but the overall measure of mitigation effectiveness is the optimized residual risk.