During a risk assessment for a new process, how should residual risk be addressed?

During a risk assessment for a new process, how should residual risk be addressed?

• A. If residual risk is zero, no further controls are needed.
• B. Residual risk is ignored once initial controls are in place.
• C. Determine residual risk after existing controls and implement improvements to reduce it further.
• D. Assume residual risk is acceptable regardless of risk level.

Answer: (C)

Residual risk management means looking at what risk remains after the existing controls are in place and using that information to decide whether more actions are needed. After you implement safeguards, you reassess to see how much risk is left and whether it meets your organization’s risk tolerance. If the residual risk is still higher than acceptable, you pursue further improvements—such as stronger controls, changes to procedures, training, or monitoring. This keeps risk reduction ongoing and avoids assuming that all risk has been eliminated or that it’s acceptable to ignore what remains.

Residual risk management means looking at what risk remains after the existing controls are in place and using that information to decide whether more actions are needed. After you implement safeguards, you reassess to see how much risk is left and whether it meets your organization’s risk tolerance. If the residual risk is still higher than acceptable, you pursue further improvements—such as stronger controls, changes to procedures, training, or monitoring. This keeps risk reduction ongoing and avoids assuming that all risk has been eliminated or that it’s acceptable to ignore what remains.