Which term describes risk after actions are taken?

Which term describes risk after actions are taken?

• A. Inherent risk
• B. Calculated risk
• C. Residual risk
• D. Solutioned risk

Answer: (C)

Residual risk is the risk that remains after controls and other risk treatment actions have been applied. It represents what could still occur despite the measures you put in place. Understanding residual risk helps determine if additional controls are needed or if the current level of risk is acceptable given the organization’s risk appetite. For example, even after implementing safeguards, a process might still carry a certain probability of loss or impact, which is the residual risk you monitor. Inherent risk describes the level of risk before any actions are taken, so it’s not describing the post-action state. The term calculated risk isn’t a standard label for post-action risk in IRM, and solutioned risk isn’t used in this context, so they don’t describe what remains after risk treatment.

Residual risk is the risk that remains after controls and other risk treatment actions have been applied. It represents what could still occur despite the measures you put in place. Understanding residual risk helps determine if additional controls are needed or if the current level of risk is acceptable given the organization’s risk appetite. For example, even after implementing safeguards, a process might still carry a certain probability of loss or impact, which is the residual risk you monitor.

Inherent risk describes the level of risk before any actions are taken, so it’s not describing the post-action state. The term calculated risk isn’t a standard label for post-action risk in IRM, and solutioned risk isn’t used in this context, so they don’t describe what remains after risk treatment.