Which of the following BEST illustrates residual risk within an organization?

The correct answer is D. Risk heat map. Residual risk is the risk that remains after controls have been applied. A risk heat map (D) visually plots risks by likelihood and impact, reflecting the current risk landscape after mitigations are in place - making it the best illustration of where residual risk sits and how…

Submitted by yaw92· Apr 18, 2026Information Security Risk Management

Question

Options

ARisk management framework
BBusiness impact analysis (BIA)
CMetrics dashboard
DRisk heat map

How the community answered

(27 responses)

B
4% (1)
C
7% (2)
D
89% (24)

Explanation

Residual risk is the risk that remains after controls have been applied. A risk heat map (D) visually plots risks by likelihood and impact, reflecting the current risk landscape after mitigations are in place - making it the best illustration of where residual risk sits and how it is distributed across the organization. A risk management framework (A) is a process structure for how risk is governed, not a depiction of risk levels. A Business Impact Analysis (B) identifies the consequences of disruptions but focuses on potential impact before controls, not residual exposure. A metrics dashboard (C) reports performance data but does not specifically represent risk posture or residual risk levels. The heat map's visual representation of current risk positioning directly illustrates residual risk.

Topics

#Residual Risk#Risk Visualization#Risk Reporting#Risk Heat Map

Community Discussion

No community discussion yet for this question.

Full CISM Practice