Question

During a risk assessment of a payment processing application, an analyst determines the inherent likelihood and impact of fraudulent transactions is very high. After documenting the automated fraud-detection controls, transaction monitoring, and dual-authorization requirements, the assessed likelihood drops significantly. When the analyst updates the risk register, which value should be recorded as the residual risk?

Accepted Answer

The risk level remaining after accounting for the effectiveness of the implemented controls

Answer

The risk level calculated before any controls were considered, to reflect worst-case exposure

Answer

The average of the inherent risk and the target risk defined in the risk appetite statement

Answer

The maximum potential loss regardless of control performance, to remain conservative