How is residual risk calculated?

• A. Residual risk = Inherent risk - impact of risk controls
• B. Residual risk = (Inherent risk) - (impact of risk controls)
• C. Residual risk = Inherent risk + impact of risk controls
• D. Residual risk = Impact of risk controls - Inherent risk

Answer: (B)

Residual risk is what remains after safeguards are applied. Inherent risk represents the level of risk before controls, and the impact of risk controls shows how much risk those controls reduce it. So the remaining risk is the inherent risk minus the risk reduction achieved by the controls.

For example, if the inherent risk is 70 on a chosen scale and the controls reduce risk by 25, the residual risk would be 45. This reflects the idea that controls diminish risk rather than add to it, and it prevents negative or illogical results that would come from adding risk or reversing the subtraction.