What level of risk is the risk categorization prior to determining and implementing mitigating actions?

The correct answer is D. Initial. In TOGAF risk management, 'Initial' risk refers to the level of risk assessed before any mitigation actions are identified or applied. This is the raw, unmitigated risk exposure. 'Residual' risk (option B), by contrast, is what remains after mitigating actions have been implement

Submitted by layla.eg· Apr 18, 2026ADM Guidelines and Techniques

Question

Options

AMarginal
BResidual
CLow
DInitial
ECritical

How the community answered

(41 responses)

B
5% (2)
C
2% (1)
D
90% (37)
E
2% (1)

Explanation

In TOGAF risk management, 'Initial' risk refers to the level of risk assessed before any mitigation actions are identified or applied. This is the raw, unmitigated risk exposure. 'Residual' risk (option B), by contrast, is what remains after mitigating actions have been implemented. The distinction is critical: you assess initial risk first, then define controls, and residual risk reflects what's left over after those controls are in place.

Topics

#Risk management#Risk categorization#Initial risk#Risk assessment

Community Discussion

No community discussion yet for this question.

Full OG0-091 Practice