Choice "A" is correct. Control activities are the methods used to implement the response to risk. Sometimes the control activity is also, effectively, the risk response.
Choice "d" is incorrect. Risk assessments involve the determination of the likelihood and impact of events on the achievement of objectives.
Choice "c" is incorrect. Inherent risk is the risk to an entity in the absence of any actions management might take to alter either the risk's likelihood or impact. Risk responses are developed to deal with inherent risk.
Choice "b" is incorrect. Residual risk is the risk that remains after management responds to the risk. The residual risk still remains after the response to the risk and the control activities are in place.