What determines if residual risk is acceptable?

• A. Initial risk level before controls.
• B. Final risk level after controls, and whether it is Acceptable, with justification and commander approval if required.
• C. Hazard name only.
• D. Number of personnel involved only.

Answer: (B)

In risk management, whether residual risk is acceptable is determined after you’ve applied controls and mitigations. You first identify hazards and assess risk, then implement safeguards, and finally reassess the risk that remains—the residual risk. Acceptance hinges on this final level: if the residual risk falls within the organization’s tolerance and decision thresholds, it is considered acceptable. Sometimes this also requires formal justification and commander approval, depending on policy and the level of risk involved.

This is why initial risk before controls isn’t the deciding factor—the safeguards change the picture, and the decision rests on what’s left after those safeguards. The hazard name or the number of people involved don’t by themselves determine acceptability; they don’t reflect how much risk remains after controls or whether that level is tolerable.