What is the impact of residual risk in risk management?

• A. It represents the remaining risk after implementing safety measures.
• B. It is the total risk before controls.
• C. It is the risk eliminated by safety measures.
• D. It is the risk that cannot be mitigated.

Answer: (A)

Residual risk is the amount of risk that remains after you’ve put in security controls and risk-reduction measures. It shows that protections reduce risk but don’t usually eliminate it completely, due to limitations like unknown threats, imperfect implementations, and system complexity. Knowing this helps you decide whether to add more safeguards or accept the remaining risk within the organization’s tolerance. It isn’t the total risk before controls, and it isn’t the risk that was fully eliminated—nor does it mean the risk can never be mitigated.