What is residual risk in RM?

• A. The risk after selecting a single control.
• B. The risk before any controls.
• C. The risk that cannot be mitigated.
• D. The remaining risk after all planned controls have been implemented.

Answer: (D)

Residual risk is the amount of risk that remains after you have implemented all planned controls to mitigate a risk. It shows how effective your safeguards are and what the organization still faces once mitigation steps are in place. This remaining risk is what you compare to the organization's risk tolerance to decide if further action is needed. It’s not the risk you start with before controls (that’s the inherent or baseline risk), nor the risk after just one control, and it isn’t necessarily “unmitigatable”—it’s simply what’s left after applying the intended controls.