The residual risk can also be the ___ risk.

• A. Initial
• B. Final
• C. Primary
• D. Secondary

Answer: (A)

Residual risk is the amount of risk that remains after you apply controls or mitigation. If no controls are in place (or if the controls don’t reduce the risk), what remains is simply the starting level of risk—the initial risk. So the residual risk can be the initial risk in that scenario. This helps illustrate how controls change risk and why comparisons between initial and residual risk are useful in communicating risk to stakeholders. The other terms don’t fit as well: final risk is the risk after mitigation in typical use, and primary/secondary are not standard labels for this relationship.