Residual calculation should reflect controls that mitigate a payment-outage risk. What must be configured?
Select an answer to reveal the explanation.
Short Explanation
Controls are the seatbelts on the risk. Link them to the payment-outage risk so residual math (or judgment) can see what is already buckling in—and what is not.
Full Explanation
Residual risk depends on understanding mitigating controls. Configuration should relate controls to the risk so assessments and residual views can factor control presence and effectiveness. Slide-only lists, automatic inherent inflation on attestation, or closing risks from knowledge links do not establish control-to-risk mapping.