ITPEC FE Morning April 2023 Question 42

Residual Risk — risk that remains after implementing risk treatment.

Residual risk is the portion of risk that persists even after controls and countermeasures have been applied.

• •Inherent risk — risk before any treatment
• •Risk reduction — the amount removed by treatment
• •Residual risk — what is left after treatment

Formula (conceptual): residual risk = inherent risk − risk reduction

Why not others:
- (a) — describes the reduced amount, not the remainder
- (b) — describes inherent risk (before any management)
- (c) — describes identified risk (before treatment is applied)

Key rule: "Residual" means "remaining" — always the leftover risk after controls are in place.

AI-generated — may contain errors