Which of the following is MOST important to consider when deciding whether to accept residual risk?

The correct answer is B. Cost of additional mitigation. Residual risk is the risk remaining after controls have already been applied. The decision to accept it is fundamentally a cost-benefit analysis: if the cost of further mitigation (B) exceeds the potential loss or impact of the risk, acceptance is the rational business decision.

Submitted by rachelw· Apr 18, 2026Information Security Risk Management

Question

Options

AClassification of the information
BCost of additional mitigation
CAnnual rate of occurrence
DCost of replacing the asset

How the community answered

(29 responses)

A
3% (1)
B
83% (24)
C
10% (3)
D
3% (1)

Explanation

Residual risk is the risk remaining after controls have already been applied. The decision to accept it is fundamentally a cost-benefit analysis: if the cost of further mitigation (B) exceeds the potential loss or impact of the risk, acceptance is the rational business decision. This is the core of risk treatment decision-making. Information classification (A) helps prioritize risks but does not directly drive the accept/treat decision. Annual rate of occurrence (C) is an input to calculating risk exposure but must be weighed against mitigation cost. Asset replacement cost (D) informs impact severity but alone does not determine whether to invest in additional controls. The cost of mitigation relative to the residual risk exposure is the deciding factor.

Topics

#Residual Risk#Risk Acceptance#Cost-Benefit Analysis#Risk Management Decision

Community Discussion

No community discussion yet for this question.

Full CISM Practice