ISC2 Governance, Risk and Compliance (CGRC) Practice Question

Residual risk is the level of risk that remains after security controls are implemented and their effectiveness has been assessed. ALE is commonly estimated as Likelihood × Impact. With the new controls in place, residual ALE = 0.08 × $1,000,000 = $80,000. Because $80,000 is higher than the organization's stated tolerance of $50,000, the residual risk is above the acceptable threshold and further risk-treatment action (such as additional mitigation, transfer, or formal acceptance by an authorized official) is required. The other options use incorrect calculations or interpret the residual risk status inaccurately: $30,000 results from multiplying the pre-control likelihood (0.30) by a reduced impact, which is not the scenario; $24,000 is based on misapplying both likelihood and impact reductions; and $300,000 represents the original inherent risk, not the residual level after controls.