Which of the following best describes residual risk?

Residual risk is best described as the overall risk that remains after specific control measures have been implemented to mitigate or reduce that risk. This concept is particularly relevant in risk management, where organizations identify potential risks and then apply various strategies—such as policies, procedures, or technology—to lower those risks to an acceptable level. After these controls are put in place, there may still be some residual risk that cannot be completely eliminated. Understanding residual risk is crucial for businesses in order to make informed decisions about whether they can accept this remaining risk or need to take further action.

The other options do not accurately capture this definition. The risk that cannot be eliminated refers to inherent risk, while external factors only pertain to specific risks but do not encompass the entire risk landscape. The original risk describes the level of risk present before any controls are in place, rather than acknowledging the adjustments made during the risk management process. By focusing on the concept of residual risk, businesses can better prepare for and respond to uncertainties in their operational environment.