After deploying new controls on a customer portal, the remaining risk is still rated above the level the board has formally stated it is willing to accept. What should the organization do next?
Select an answer to reveal the explanation.
Short Explanation
Risk appetite is the line the board drew in the sand, and residual risk is where you landed after your controls. If you're still on the wrong side of the line, you keep treating. The trap is 'we tried, so accept it', which quietly overrules the board.
Full Explanation
Residual risk is the risk that remains after controls are applied, and risk appetite is the amount and type of risk the organization's leadership is willing to pursue or retain. When residual risk exceeds appetite, the risk is not yet acceptable under the organization's own governance, so further treatment is required: more or stronger controls, transferring part of the impact, or avoiding the activity. The point of defining appetite is to provide that decision rule. Accepting the residual risk simply because some controls were applied ignores the stated threshold; effort spent is not the test, the resulting risk level is. Removing the new controls because they did not eliminate risk misunderstands the goal; controls reduce risk, almost never to zero, and removing them would increase exposure further. Lowering the bar by raising the stated appetite to match the current rating is a governance change only the board can make, and doing it to make a single number fit defeats the purpose of having an appetite at all. Exam caveat: an explicit, documented exception approved by the appropriate authority is possible in some programs, but it is a formal decision rather than a default. Operational check: compare the register's residual rating with the documented appetite, record the gap, and assign an owner and date for the additional treatment.