Which option correctly identifies the RAM assessment type enabled by default for RAM configurations?

Which option correctly identifies the RAM assessment type enabled by default for RAM configurations?

• A. Residual Assessment
• B. Inherent Assessment
• C. Control Assessment
• D. Operational Risk Assessment

Answer: (A)

The key idea here is how RAM evaluates risk at different stages. In these configurations, the default setup focuses on the Residual Risk assessment, which looks at the risk that remains after controls and mitigations are in place. This is why it’s the default: it gives you a clear picture of the actual risk posture you still need to manage, guiding decisions about whether to strengthen controls or accept the remaining risk. Understanding the other options helps as well: Inherent risk assesses risk before any controls are applied, so it’s about the raw level of threat. Control assessment evaluates how effective the controls are—i.e., how well they reduce risk. Operational risk assessment addresses day-to-day operational exposures. Each serves a purpose, but the standard starting point is the residual risk view, since it reflects what you still need to manage after implementing controls.

The key idea here is how RAM evaluates risk at different stages. In these configurations, the default setup focuses on the Residual Risk assessment, which looks at the risk that remains after controls and mitigations are in place. This is why it’s the default: it gives you a clear picture of the actual risk posture you still need to manage, guiding decisions about whether to strengthen controls or accept the remaining risk.

Understanding the other options helps as well: Inherent risk assesses risk before any controls are applied, so it’s about the raw level of threat. Control assessment evaluates how effective the controls are—i.e., how well they reduce risk. Operational risk assessment addresses day-to-day operational exposures. Each serves a purpose, but the standard starting point is the residual risk view, since it reflects what you still need to manage after implementing controls.