Which statement best defines residual risk?

• A. Inherent risk is risk after controls; residual risk remains before controls.
• B. Residual risk is risk that remains after controls.
• C. Inherent risk is risk that cannot be reduced.
• D. Residual risk is risk that is entirely eliminated by controls.

Answer: (B)

Residual risk is the risk that remains after controls have been applied. In risk management, you start with inherent risk—the level of risk before safeguards. Implementing controls reduces that risk, but nothing is perfect, so some risk still exists and must be monitored or managed. This is why residual risk cannot be eliminated completely.

The other statements mix up the timing or meaning: inherent risk is not after controls, it’s the risk before safeguards. Inherent risk can be reduced by controls, so saying it cannot be reduced isn’t accurate. And residual risk is not entirely eliminated; by definition, it’s what remains after controls.