Residual risk is the risk that remains after which step of the risk treatment process?

• A. After incident response
• B. After risk transfer
• C. After mitigation actions
• D. After escalation

Answer: (C)

Residual risk is the risk that remains after mitigation actions are in place. In the risk treatment process you first assess the inherent risk and then apply controls to reduce it. Once those controls are implemented, you evaluate what’s left—that leftover risk is the residual risk. It’s this remaining level that you decide whether to accept, or you add more safeguards to bring it down further.

For example, patching vulnerabilities and tightening access reduce overall risk, but there may still be some threat from unknown exploits or insider actions. That leftover risk is what you manage next, rather than the risks present before any controls.

This concept isn’t tied to incident response (which deals with handling active incidents), risk transfer (which shifts risk to another party), or escalation (which raises the issue to higher authority).