When some risk identified as acceptable then one of the following is not required.

When risk is identified as acceptable, actions to lower that risk are not required. Risk mitigation is defined as the process of modifying a risk to reduce it to an acceptable level. If the risk is already acceptable, this process is not necessary. Similarly, risk reduction, the general process of lowering risk, is also not required. Risk evaluation, however, is the process that must be completed to determine that the risk is acceptable in the first place. Therefore, both risk reduction and risk mitigation are not required.

B. Risk evaluation: This process is required to determine if the risk is acceptable or not. It precedes the decision.
D. Risk control: This is a broad term for managing risk, often involving risk reduction measures, which are not required for acceptable risks.

1. API Recommended Practice 580, Risk-Based Inspection, Third Edition, 2016. Section 3.1.71, "Risk Mitigation: The process of modifying a risk to reduce it to an acceptable level."

2. API Recommended Practice 580, Risk-Based Inspection, Third Edition, 2016. Section 3.1.68, "Risk Evaluation: Process used to compare the estimated risk against given risk criteria to determine the significance of the risk."

3. API Recommended Practice 580, Risk-Based Inspection, Third Edition, 2016. Section 3.1.70, "Risk Reduction: The process of lowering the level of risk."