In risk management, what is the goal when a physical control is added to mitigate a hazard?

• A. Eliminate the hazard entirely
• B. Evaluate effectiveness and ensure residual risk is acceptable
• C. Ignore residual risk
• D. Increase exposure

Answer: (B)

Adding a physical control is about reducing the risk to a safer level and then confirming that reduction. The goal is to evaluate how well the control works and ensure the remaining risk after implementing the control—the residual risk—is within the organization’s acceptable risk tolerance. If the residual risk is too high, you adjust the control or add additional measures until it is acceptable. This mirrors real risk management: you might not eliminate the hazard completely, but you strive to make the risk tolerable through effective controls, ongoing verification, and maintenance. Ignoring residual risk or increasing exposure would defeat the purpose of mitigation.