Key risk indicators (KRIs) are metrics that help organizations monitor and assess potential risks that may impact their operations, financial health, or overall performance1. KRIs should have certain characteristics that make them effective for risk monitoring, such as:
Ability to measure the right thing (e.g., supports the decisions that need to be made) Quantifiable (e.g., damages in dollars of profit loss) Capability to be measured precisely and accurately Relevant (measuring the right thing associated with decisions)2 Among the four options given, only option C (sensitivity to changes in risk levels) best enables effective risk monitoring. This is because KRIs should be able to capture the changes in risk levels over time and alert organizations to emerging or escalating risks3. A high sensitivity to changes in risk levels indicates that theKRI is responsive and timely, and can help organizations take preventive or corrective actions before the risks become too severe.
References = Key Risk Indicators: A Practical Guide, Key Risk Indicators: Examples & Definitions, Key Risk Indicators - Wikipedia

According to the CRISC Review Manual, an enterprise-wide ethics training and awareness program is one of the key elements of a strong risk culture, as it helps to promote ethical behavior, raise awareness of risk management principles and practices, and foster a culture of accountability and transparency2
1: Developing Collective Risk Leadership Through CRISC - ISACA 2: CRISC Review Manual, 7th Edition, page 23

Role of the System Owner:
The system owner is responsible for the overall operation and management of an application or system. This includes ensuring that technical controls are implemented and functioning as intended.
They have detailed knowledge of the system's architecture, the controls in place, and how those controls are applied within the system.
Effectiveness of Technical Controls:
Assessing the effectiveness of a technical control requires understanding its implementation, configuration, and operational context.
The system owner is best positioned to provide this information as they manage and oversee the technical environment of the application.
Comparing Other Roles:
Internal Auditor:While auditors review and evaluate the effectiveness of controls, they do so from an independent standpoint and might not have detailed, day-to-day operational insights.
Process Owner:The process owner focuses on business processes rather than technical controls specific to an application.
Risk Owner:The risk owner is responsible for managing risk but may not have the technical expertise or detailed operational knowledge of the system.
Supporting Information:
According to the CRISC Review Manual, the system owner is often involved in the assessment and reporting of control effectiveness, especially regarding technical controls (CRISC Review Manual, Chapter 3: Risk Response and Mitigation, Section 3.1.3 Assessing Control Effectiveness) .

Residual risk is the risk that remains after security controls have been implemented on a system. Residual risk can be accepted, transferred, avoided, or further mitigated. The most important consideration when deciding whether to accept residual risk is the cost versus benefit of additional mitigating controls. This means comparing the potential impact of the residual risk with the cost and effectiveness of implementing more controls to reduce it. If the cost of additional controls outweighs the benefit of reducing the residual risk, then it may be acceptable to accept the residual risk. However, if the benefit of additional controls exceeds the cost, then it may be advisable to implement more controls to lower the residual risk to an acceptable level. References = Risk and Information Systems Control Study Manual, Chapter 3: Risk Response and Mitigation, Section 3.4: Risk Response Selection, p. 156-157.