Residual risk is defined as:

• A. The risk level that exists only before controls
• B. The level of risk that exists with all of the necessary controls in place
• C. The risk of third-party non-compliance
• D. The risk of market volatility

Answer: (B)

Residual risk is the risk that remains after you have implemented the necessary controls. It recognizes that controls reduce risk but don’t eliminate it completely, due to imperfect controls, gaps, or the inherent remaining risk in the environment. This is different from the risk present before controls are applied, and it’s not focused on specific categories like third-party non-compliance or market volatility. The defining idea is the remaining level of risk once all appropriate controls are in place.