Risk that remains after risk mitigation is known as

An organization has a stated requirement to block certain traffic on networks. The implementation of controls will disrupt a manufacturing process and cause unacceptable delays, resulting in sever revenue disruptions.
Which of the following is MOST likely to be responsible for accepting the risk until mitigating controls can be implemented?

The new CISO was informed of all the Information Security projects that the organization has in progress.
Two projects are over a year behind schedule and over budget. Using best business practices for project management you determine that the project correctly aligns with the company goals.
Which of the following needs to be performed NEXT?

Which of the following are necessary to formulate responses to external audit findings?

Which of the following international standards can be BEST used to define a Risk Management process in an organization?