Installing a motion detection system is a risk reduction strategy because it lowers the likelihood or impact of after-hours theft. The organization continues to operate the warehouse but implements a control to detect or deter unauthorized activity. Risk avoidance would mean discontinuing the activity that creates the risk, such as no longer storing goods in the warehouse. Risk elimination is generally unrealistic because most risks cannot be completely removed. Risk sharing would involve transferring or distributing risk through mechanisms such as insurance, outsourcing, or contractual arrangements. Internal auditors evaluating enterprise risk management should verify whether selected responses align with risk appetite and whether controls are designed and operating effectively. Because the motion detection system mitigates theft risk rather than avoiding or transferring it, Option B is correct.