In the context of the risk management process, what does the term 'residual risk' refer to?

Question

Options

• AThe risk that remains after all possible controls and countermeasures have been applied
• BThe total elimination of risk within an organization
• CThe risks that are considered irrelevant or insignificant
• DThe risk associated with an organization's assets before any controls are implemented

• A
  89% (40)
• B
  7% (3)
• C
  2% (1)
• D
  2% (1)

Explanation

Residual risk is the level of risk that remains after an organization has identified, assessed, and applied controls or countermeasures to mitigate it. No set of controls can eliminate all risk, so residual risk always exists to some degree. Option B is incorrect because total elimination of risk is generally impossible. Option C describes risks that have been accepted as insignificant (accepted risk). Option D describes inherent risk - the raw risk before any controls are applied. Residual risk is the key metric management must accept or further mitigate.

No community discussion yet for this question.