What is residual risk?

• A. The risk remaining after controls are applied.
• B. The risk before applying controls.
• C. The risk eliminated completely.
• D. The risk remaining after controls are applied.

Answer: (A)

Residual risk is the risk that remains after you’ve put controls and mitigations in place. Even with safeguards, no system is perfect, so some exposure persists due to imperfect effectiveness, new or unknown threats, or gaps in controls. This leftover risk is what you assess against the organization’s risk appetite to decide if more action is needed. By comparison, risk before controls is the inherent (unmitigated) risk, and claiming all risk is eliminated would describe zero risk, which residual risk is not. A practical example is a security upgrade: firewalls and patches reduce the chance of a breach, but some residual risk remains from user behavior or zero-day flaws.