Question

After implementing a new set of controls on a customer-facing payment application, a risk analyst measures the residual risk and finds it is still slightly above the organization's stated risk appetite. The cost of implementing additional controls to close the remaining gap would exceed the projected annualized loss from the residual exposure by a wide margin. What should the risk analyst recommend to management?

Accepted Answer

Escalate the residual risk to management with the cost-benefit analysis so an informed acceptance or alternative treatment decision can be made

Answer

Implement the additional controls regardless of cost, because residual risk must always be reduced below the risk appetite

Answer

Adjust the risk appetite upward so the residual risk falls within tolerance and no further action is needed

Answer

Remove the risk from the risk register because the existing controls have already been implemented