What term describes the level of risk remaining after control measures are applied?

What term describes the level of risk remaining after control measures are applied?

• A. Inherent Risk
• B. Risk Appetite
• C. Residual Risk
• D. Tolerable Risk

Answer: (C)

The level of risk remaining after control measures are applied is called residual risk. This captures what’s left after you’ve put in mitigations to reduce the original exposure. Think of inherent risk as the danger present before any controls, and residual risk as the danger that persists once those controls are in place. Risk appetite describes how much risk an organization is willing to accept in pursuing its objectives, while tolerable or acceptable risk refers to the level judged acceptable after mitigation, which often aligns with residual risk but is broader in policy terms. In practical terms, if you implement controls and the risk rating drops but doesn’t go to zero, that remaining rating is residual risk.

The level of risk remaining after control measures are applied is called residual risk. This captures what’s left after you’ve put in mitigations to reduce the original exposure.

Think of inherent risk as the danger present before any controls, and residual risk as the danger that persists once those controls are in place. Risk appetite describes how much risk an organization is willing to accept in pursuing its objectives, while tolerable or acceptable risk refers to the level judged acceptable after mitigation, which often aligns with residual risk but is broader in policy terms. In practical terms, if you implement controls and the risk rating drops but doesn’t go to zero, that remaining rating is residual risk.