CGRC · Question #432
A key part of the risk-based decision process is the recognition that regardless of the risk response, There remains some risks known as: Response:
The correct answer is C. Residual risk. After implementing risk responses, such as mitigation, there will always be some level of remaining risk, which is known as residual risk. This remaining risk is formally accepted by management.
Question
A key part of the risk-based decision process is the recognition that regardless of the risk response, There remains some risks known as:
Response:
Options
- ARisk analysis
- BRisk mitigation
- CResidual risk
- DRisk tolerance level
How the community answered
(48 responses)- A4% (2)
- C94% (45)
- D2% (1)
Why each option
After implementing risk responses, such as mitigation, there will always be some level of remaining risk, which is known as residual risk. This remaining risk is formally accepted by management.
Risk analysis is the process of identifying and assessing risks, not the remaining risk itself.
Risk mitigation refers to the actions taken to reduce the likelihood or impact of a risk, not the risk that remains afterwards.
Residual risk is the risk that remains after all risk responses, including mitigation efforts, have been implemented. Organizations must decide whether to accept this remaining risk based on their risk tolerance.
Risk tolerance level is the acceptable level of variation relative to the achievement of objectives, which helps in deciding whether to accept residual risk, but it is not the remaining risk itself.
Concept tested: Definition of residual risk
Source: https://csrc.nist.gov/glossary/term/residual-risk
Topics
Community Discussion
No community discussion yet for this question.