Which of the following provides the BEST evidence that risk responses are effective?

Risk responses are implemented to reduce inherent risk to an acceptable level of residual risk. If the residual risk is within the organization's established risk tolerance, it indicates that the implemented risk responses are successfully managing the risk to an acceptable state.

Accepting low-impact risk is a risk treatment strategy, not evidence of the effectiveness of a response for a specific risk.

Identifying risk ownership is a critical step in risk management, but it doesn't provide evidence of the effectiveness of implemented controls or responses.

Addressing compliance breaches in a timely manner is a reactive measure for control failures, not proactive evidence that risk responses are fundamentally effective in maintaining risk within tolerance.