Residual system access is the risk that the customer service representatives who are transferred to the sales department may still have access to the systems or applications that they used in their previous role, which may not be relevant or authorized for their new role.
The access control manager is the person or function who is responsible for defining, implementing, and maintaining the policies and procedures for granting, modifying, reviewing, and revoking access rights to the systems or applications, based on the principle of least privilege and the segregation of duties.
The access control manager is responsible for mitigating the risk associated with residual system access, by ensuring that the access rights of the customer service representatives are updated or removed according to their new role and responsibilities, and that the access changes are documented and approved by the appropriate authorities.
The other options are not responsible for mitigating the risk associated with residual system access. They are either irrelevant or less effective than the access control manager.
The references for this answer are:
Risk IT Framework, page 26
Information Technology & Security, page 20
Risk Scenarios Starter Pack, page 18

Communicating risk assessments to senior management is crucial for ensuring that key decision-makers are aware of the organization's risk landscape. This awareness enables informed decision-making regarding risk responses, resource allocation, and strategic planning. It also fosters a risk-aware culture throughout the organization.
Reference:ISACA CRISC Review Manual, 7th Edition, Chapter 3: Risk Response and Reporting, Section:
Risk Communication.

The policy has not been approved by the organization's board should be of most concern, as it indicates a lack of governance and oversight for the organization's cybersecurity posture. The board is ultimately responsible for setting the strategic direction, objectives, and risk appetite of the organization, and for ensuring that the cybersecurity policy aligns with them. Without the board's approval, the policy may not reflect the organization's vision, mission, values, and culture, and may not be communicated, implemented, or enforced effectively. The board's approval also demonstrates the commitment and support of the senior management for the cybersecurity program, and enhances the accountability and responsibility of the stakeholders involved.
References:
*ISACA, Essential Functions of a Cybersecurity Program1
*ISACA, Cybersecurity: Based on the NIST Cybersecurity Framework2

User recertification is the most effective control to ensure user access is maintained on a least-privilege basis, as it involves a periodic review and validation of user access rights and privileges by the appropriate authority. User recertification helps to identify and remove any unnecessary, excessive, or obsolete access rights and privileges that may pose a security risk or violate the principle of least privilege. User recertification also helps to ensure that user access rights and privileges are aligned with the current business needs, roles, and responsibilities of the users.
The other options are not the most effective controls to ensure user access is maintained on a least-privilege basis. User authorization is the process of granting or denying access rights and privileges to users based on their identity, role, and credentials, but it does not verify or update the existing access rights and privileges of the users. Change log review is the process of examining and analyzing the records of changes made to the system, configuration, or data, but it does not directly address the user access rights and privileges. Access log monitoring is the process of tracking and auditing the user activities and actions on the system or network, but it does not validate or modify the user access rights and privileges. References = What Is the Principle of Least Privilege and Why is it Important?, Principle of Least Privilege: Definition, Methods & Examples, IT Risk Resources | ISACA

Conducting User Acceptance Testing (UAT) is the best way for an organization to avoid situations where users voice concerns about missing functionality after a system implementation.
User Acceptance Testing (UAT):
Definition:UAT involves testing the system with actual users to ensure it meets their needs and requirements.
It verifies that the system performs in real-world scenarios as expected by the users.
Involvement of Users:UAT includes the end-users in the testing process, ensuring that their feedback is incorporated and that the system functionalities align with their expectations.
Benefits:
Identifying Gaps:UAT helps in identifying gaps between the delivered system and user expectations. This early detection allows for adjustments before the system goes live.
Improved Satisfaction:By involving users in the testing process, the likelihood of the system meeting their needs increases, leading to higher user satisfaction and reduced post-implementation issues.
References:
The CRISC Review Manual and best practices in project management emphasize the importance of UAT in ensuring that the system meets user requirements and avoids post-implementation functionality concerns .