What is residual risk in RM?

• A. The risk remaining after applying controls.
• B. The risk that is ignored.
• C. The initial risk before any controls.
• D. The risk that cannot be evaluated.

Answer: (A)

Residual risk is the risk that remains after you’ve put controls in place to reduce the initial risk. It’s the portion you still face despite mitigation, because no control perfectly eliminates danger and new issues can emerge over time. You monitor and reassess this remaining risk to decide if more controls are needed or if the level is acceptable. It isn’t the initial risk before controls, since that gets reduced by safeguards; it isn’t the risk ignored, because you do evaluate and act on risks you identify; and it isn’t something you can’t evaluate, because residual risk is specifically what you quantify after applying controls.