The risk practitioner should report that the associated risk has been deferred, as this means that the risk response has been postponed or delayed due to lack of resources or other constraints. Deferring a risk response implies that the risk owner acknowledges the risk and intends to implement the risk mitigation action plan at a later stage, when the resources or conditions are available. The other options are not correct, as they do not reflect the actual status of the risk response. Mitigating a risk means that the risk response has been implemented and the risk level has been reduced. Accepting a risk means that the risk response has been rejected or waived, and the risk level has been accepted as it is. Avoiding a risk means that the risk response has beenimplemented and the risk level has been eliminated or transferred. References = Risk and Information Systems Control Study Manual, Chapter 4: Risk Response, page 146.