How should residual risk be documented?

• A. By recording only the initial risk level.
• B. By recording the final risk level after controls, and whether it is Acceptable, with justification and commander approval if required.
• C. By listing only the controls used, not the risk level.
• D. By recording the risk level after the mission only.

Answer: (C)

Residual risk is the risk that remains after applying mitigation controls. Documenting it means capturing the risk level after those controls are in place and indicating whether that remaining risk is acceptable, with any necessary justification and commander approval. This lets decision-makers see the actual danger level left and decide if more controls are needed, the mission should proceed, or adjustments are required. Merely listing the controls doesn’t tell you how much risk remains, and recording only the initial risk level ignores the impact of the mitigations. So the proper documentation communicates the final risk, the acceptance decision, and who approved it, ensuring clear accountability and guidance for next steps.