CRISC: Certified in Risk and Information Systems ControlDemo

Residual risk is the exposure that remains after controls and other risk treatments are applied. It can be compared directly with the organization’s established risk appetite to determine whether the remaining level of risk is acceptable.