Residual risk after applying controls is acceptable only when it meets defined criteria. True or false?

• A. True
• B. False
• C. Unknown
• D. Eliminated

Answer: (A)

The key idea is that risk management aims to bring risk down to a level the organization considers acceptable. After applying controls, what remains is residual risk, and it’s only acceptable if it falls within predefined criteria—such as risk tolerance, mission impact limits, or other risk acceptance thresholds. If the residual risk is within those boundaries, you can proceed; if it isn’t, you either add more controls, improve processes, or escalate the decision to accept the remaining risk with proper justification.

In practice, you set these criteria up front so you know what level of risk is tolerable. For example, a task might have a residual risk that is higher than your tolerance, so you’d look for further mitigation rather than labeling the risk as acceptable. Eliminated risk would imply zero risk, which is rarely achievable; unknown risk isn’t acceptable because you’ve not met the requirement to assess and define risk levels. So the statement is true: residual risk after applying controls is acceptable only when it meets defined criteria.