The correct option is Formal acceptance of residual risk.

Formal acceptance of residual risk must remain with senior leadership or the designated business risk owner because accepting residual risk is a business level decision that involves legal financial and strategic consequences and therefore requires the authority and accountability that lower level staff do not hold.

Conducting risk assessments is incorrect because assessments can be performed by qualified analysts auditors or external assessors and the results can be used to inform the decision makers who accept or reject risk.

Implementing security controls is incorrect because deployment and technical management of controls is an operational task that is normally delegated to technical teams or contractors while management retains responsibility for ensuring controls meet business needs.

Overseeing risk management programs is incorrect because the day to day oversight can be delegated to a risk manager or security office to run the program while senior leadership retains ultimate accountability and must formally accept residual risk.

Full AWS Practitioner Certification Question