Define residual risk.

• A. Risk before any controls are applied.
• B. Risk eliminated by controls.
• C. Risk remaining after controls have been implemented.
• D. Inherent risk only from third parties.

Answer: (C)

Residual risk is the risk that remains after controls and risk treatments have been put in place. It represents the exposure that can’t be fully eliminated despite safeguards, monitoring, and response measures. This remaining risk is what you compare to your risk appetite to decide if more controls are needed or if you’re willing to accept it.

For example, applying encryption and access controls reduces the chance and impact of a breach, but some residual risk still exists due to factors like human error, evolving threats, or unpatched vulnerabilities. That leftover risk is residual risk.

It’s not risk before controls (that’s inherent risk), it’s not risk eliminated by controls (elimination would be zero risk), and it isn’t limited to third-party origins.