How do you quantify residual risk after implementing mitigations? Why is it important?

How do you quantify residual risk after implementing mitigations? Why is it important?

• A. Ignore residual risk after mitigations.
• B. Reassess likelihood and impact after controls; use risk scoring to decide further mitigations and communicate risk to leadership.
• C. Only measure cost of mitigations, not risk.
• D. Use random guess to assess risk.

Answer: (B)

Quantifying residual risk after mitigations means re-assessing how likely an event is and how severe its impact would be, once controls are in place, and turning that into a risk score. This gives you a numeric sense of what remains risk-wise and lets you compare it to your organization’s risk appetite. With that score, you can decide if you need additional mitigations and you have a clear basis for reporting risk to leadership and stakeholders. This approach matters because risk is not eliminated by controls—it’s reduced to a residual level that must still be understood and managed. A standardized score helps prioritize further actions, guides resource allocation, and supports governance and ongoing improvement. If the residual risk is acceptable, you can document acceptance and set up monitoring; if not, you pursue more controls or compensating measures. Why not other options: ignoring residual risk leaves you vulnerable to unforeseen problems; measuring only the cost of mitigations ignores whether risk has actually been reduced; and guessing randomly is not a reliable or defensible method for risk decisions.

Quantifying residual risk after mitigations means re-assessing how likely an event is and how severe its impact would be, once controls are in place, and turning that into a risk score. This gives you a numeric sense of what remains risk-wise and lets you compare it to your organization’s risk appetite. With that score, you can decide if you need additional mitigations and you have a clear basis for reporting risk to leadership and stakeholders.

This approach matters because risk is not eliminated by controls—it’s reduced to a residual level that must still be understood and managed. A standardized score helps prioritize further actions, guides resource allocation, and supports governance and ongoing improvement. If the residual risk is acceptable, you can document acceptance and set up monitoring; if not, you pursue more controls or compensating measures.

Why not other options: ignoring residual risk leaves you vulnerable to unforeseen problems; measuring only the cost of mitigations ignores whether risk has actually been reduced; and guessing randomly is not a reliable or defensible method for risk decisions.