Which term describes the risk that remains after countermeasures have been deployed?

Which term describes the risk that remains after countermeasures have been deployed?

• A. Inherent risk
• B. Operational risk
• C. Control risk
• D. Residual risk

Answer: (D)

Residual risk is the risk that remains after countermeasures have been deployed. When you implement controls, you reduce the amount of risk to a lower level, but you can’t eliminate every threat or vulnerability. New threats can emerge, existing flaws can be overlooked, and controls can have gaps or fail under certain conditions. Inherent risk represents the level of risk before any controls, while residual risk shows the amount left after protections are in place. Operational risk refers to risks arising from day-to-day processes and operations, and control risk is a term often used in auditing to describe the possibility that controls won’t detect or prevent misstatements. So the leftover risk after applying defenses is the residual risk.

Residual risk is the risk that remains after countermeasures have been deployed. When you implement controls, you reduce the amount of risk to a lower level, but you can’t eliminate every threat or vulnerability. New threats can emerge, existing flaws can be overlooked, and controls can have gaps or fail under certain conditions. Inherent risk represents the level of risk before any controls, while residual risk shows the amount left after protections are in place. Operational risk refers to risks arising from day-to-day processes and operations, and control risk is a term often used in auditing to describe the possibility that controls won’t detect or prevent misstatements. So the leftover risk after applying defenses is the residual risk.