An organization deploys a control to protect an important data asset. What should its risk documentation do next, and why?

### The concept A control is a measure intended to reduce risk, not proof that risk has disappeared. After applying it, the organization should revisit the scenario and assess the remaining likelihood and impact. The result is residual risk. Documenting that result supports informed decisions about whether more controls or other action may be needed. ### What a good answer covers - Says to reassess after applying the control. - Defines the result as residual risk. - Explains that controls may reduce, rather than eliminate, risk. ### Terms - **Residual risk**: Risk remaining after controls are applied. - **Control**: A technical or administrative measure intended to reduce risk. ### Remember A control changes the assessment; it does not replace reassessment.