While reviewing wire transfer procedures, the Chief Information Security Officer (CISO) of a bank discovers a flaw in the policy that can potentially allow for some wire transfers to occur without…

Residual risk is the risk remaining after all planned controls including primary controls are fully in place, whereas here the focus is on the act of reducing risk via a compensating control rather than what persists after a full control framework is applied.

Mitigated risk describes risk that has been reduced through the deliberate application of a control or countermeasure - in this case the compensating control deployed by operational staff to close the policy gap. The CISO's continued concern stems from the fact that the mitigation reduced but did not fully eliminate the exposure, which is the defining characteristic of a mitigated risk state.

Inherent risk is the level of risk that exists before any controls are applied at all, which does not apply here because a compensating control has already been implemented.

Accepted risk means an organization has acknowledged a risk and chosen not to mitigate it further, which contradicts the scenario where the CISO actively recommended and deployed a compensating control.