ITPEC FE Morning April 2023 Question 42

Which of the following is residual risk?

a)Amount of risk that is reduced by implementing risk treatmentb)Risk that exists prior to performing any risk management activitiesc)Risk that is identified prior to implementing risk treatmentd)Risk that remains after implementing risk treatment

Explanation

Risk that remains after risk treatment — 'residual' means what is left over once the controls are in place.

Risk treatment (reduce, transfer, avoid or accept) rarely removes a risk completely. ISO 31000 and ISO/IEC 27000 define residual risk as the risk remaining after risk treatment. Management must formally accept it or treat it further.

Answer (d)

Why not others:

•(a) — the amount removed by the treatment is the risk reduction, the opposite of what remains
•(b) — the risk that exists before any risk management activity is the inherent risk
•(c) — a risk identified before treatment is the untreated output of risk identification, so nothing has yet been applied to leave a residue

Key rule: Inherent risk minus the effect of the controls is the residual risk, and the risk owner has to accept it explicitly.

Security · AI-written, may contain errors

Previous Next

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.