Which statement describes the acceptable level of risk?

• A. The residual risk deemed tolerable by stakeholders or mission requirements
• B. Zero risk
• C. Uncertain risk
• D. Not measurable

Answer: (A)

In risk management, the acceptable level of risk is the residual risk that stakeholders or mission requirements consider tolerable. After applying controls and mitigation efforts, some risk remains; that leftover risk is the residual risk. The key is defining how much of that residual risk stakeholders are willing to accept to achieve the mission within available resources and constraints. Since zero risk is rarely achievable in real operations, the goal is to reduce risk to a level that is acceptable and affordable, not to eliminate it entirely. Uncertain risk isn’t a judgment about acceptability, and not measurable risk isn’t workable because you need to quantify risk to determine whether it meets the tolerance.