CISA: Certified Information Systems Auditor

An effective risk management program applies controls and risk treatments to reduce residual risk—the risk that remains after those measures—to an acceptable minimum. Inherent risk exists before controls, while risk quantification alone does not show that risk has been effectively reduced.