Question

If an organization calculates its inherent risk as 80 and the impact of existing controls is 30, what is the resulting residual risk value?

Accepted Answer

The resulting residual risk value is 50. To determine this, you subtract the impact of existing controls from the inherent risk. Inherent risk represents the total level of risk present in a process or activity before any actions are taken to mitigate it. Controls are the policies, procedures, or technologies implemented to reduce that risk. Residual risk is the remaining level of risk that persists after those controls have been applied. In this calculation, the inherent risk of 80 minus the control impact of 30 leaves a residual risk of 50.

Home → All Courses → Law and Criminal Justice Courses → Governance, Risk & Compliance (GRC) Certification → Flashcard

If an organization calculates its inherent risk as 80 and the impact of existing controls is 30, what is the resulting residual risk value?

The resulting residual risk value is 50. To determine this, you subtract the impact of existing controls from the inherent risk. Inherent risk represents the total ....