Controls for the EHR risk are documented, including preventive MFA and compensating monitoring. What assessment comes next?
Select an answer to reveal the explanation.
Short Explanation
After the umbrella is up, ask how wet you still get. That leftover exposure is residual risk — score it once the controls are on the record.
Full Explanation
After documenting controls for the EHR risk—including preventive MFA and compensating monitoring—the risk owner should assess residual risk after those controls. Residual reflects remaining exposure for the clinical system once safeguards are considered. Reassessing only inherent risk and ignoring control effects going forward fails by concept because inherent alone does not show post-control posture. Deleting inherent scores so only qualitative comments remain fails by concept because discarding inherent removes the baseline needed to interpret residual reduction. Closing the risk automatically whenever any control record exists fails by concept because linkage without effectiveness and residual assessment is not treatment. Exam caveat: CIS-RC assesses residual after documenting applicable preventive and compensating controls while retaining inherent for comparison. Operational check: with MFA and monitoring documented on the EHR risk, complete residual likelihood and impact, compare to inherent, and confirm both scores remain on the risk record for governance. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.