Risk mitigation involves the development and implementation of action plans to reduce identified risks to an acceptable level, in line with the institution's risk appetite. The effectiveness of these mitigation strategies is continuously monitored and measured using Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs). These metrics provide objective data on how well controls are working and whether risk levels are changing, allowing for timely adjustments to the action plans.

A. This is too narrow; mitigation plans address all identified AML/CFT risks, not just those tied to OFAC and FinCEN rules.

B. While related, action plans are tied to specific risks identified in the risk assessment, not just the overall business portfolio.

C. The CEO's approval is part of the governance framework, not the definition or direct mechanism of risk mitigation itself.

1. ACAMS CAMS-RM Study Guide (2023). Chapter 2: The Risk Management Framework, Section: "Risk Mitigation," pp. 2-25 - 2-27. (Details the role of action plans, KPIs, and KRIs in the "Mitigate" phase of the risk management lifecycle).

2. ACAMS CAMS-RM Study Guide (2023). Chapter 5: Measuring and Monitoring Risk, Section: "Key Risk Indicators (KRIs)," pp. 5-10 - 5-12. (Explains how KRIs are used to monitor the control environment and the effectiveness of mitigation efforts).