Which term describes exposure after considering risk responses?

Which term describes exposure after considering risk responses?

• A. Inherent risk
• B. Residual risk
• C. Impact
• D. Likelihood

Answer: (B)

Exposure after applying risk responses is known as residual risk. In risk management, you start with inherent risk—the level of risk present before any controls. Then you implement mitigations, policies, and controls to reduce that risk. The remaining exposure, after these measures are in place, is the residual risk. It reflects what could still go wrong despite the safeguards, due to imperfect controls, evolving threats, or human error. While impact and likelihood describe the potential severity and probability of a risk event, they are parts of assessing risk overall; they describe the event’s characteristics, not the post-mitigation exposure itself. Understanding residual risk helps determine if additional controls or risk‑acceptance within the organization’s tolerance is appropriate.

Exposure after applying risk responses is known as residual risk. In risk management, you start with inherent risk—the level of risk present before any controls. Then you implement mitigations, policies, and controls to reduce that risk. The remaining exposure, after these measures are in place, is the residual risk. It reflects what could still go wrong despite the safeguards, due to imperfect controls, evolving threats, or human error. While impact and likelihood describe the potential severity and probability of a risk event, they are parts of assessing risk overall; they describe the event’s characteristics, not the post-mitigation exposure itself. Understanding residual risk helps determine if additional controls or risk‑acceptance within the organization’s tolerance is appropriate.