In risk assessment, what does residual risk mean?

• A. The initial risk level before any controls
• B. The risk that cannot be mitigated due to design flaws
• C. The risk associated with supply chain disruptions
• D. The remaining level of risk after all protective measures have been applied.

Answer: (D)

Residual risk is the level of risk that remains after protective measures have been put in place. You start with the inherent risk from hazards, then apply controls to reduce either the likelihood, the consequences, or both. Because no control is perfect, some risk always sticks around, due to limitations in the controls, human factors, or unknowns. This remaining risk is what you assess against acceptance criteria to decide if you need more controls or ongoing monitoring. The other descriptions refer to risk before controls, risks that can’t be mitigated by design, or risk in a specific area, none of which capture the idea of what remains after mitigation.