Showing projected residual risk is the most helpful way to respond to the request of explaining how existing risk treatment plans would affect risk posture at the end of the year. Residual risk is the level of risk that remains after the implementation of risk responses1. Projected residual risk is the estimated level of risk that will remain at a future point in time, based on the assumptions and expectations of the risk responses2. By showing projected residual risk, the risk practitioner can:
Demonstrate the effectiveness and efficiency of the risk treatment plans, and how they reduce the risk level from the inherent risk (the risk before the risk responses) to the residual risk3.
Compare the projected residual risk with the risk appetite and tolerance, which are the amount and type of risk that the organization is willing to accept or pursue in order to achieve its objectives4. This can help to determine whether the projected residual risk is acceptable or not, and whether the risk treatment plans are consistent and proportional to the risk level5.
Identify and address any gaps, issues, or challenges that may affect the achievement of the projected residual risk, and recommend and implement appropriate improvement actions or contingency plans6.
The other options are not the most helpful ways to respond to the request, because:
Assessing risk with no controls in place is not the most helpful way, as it does not reflect the current or future risk posture of the organization. Controls are the measures or actions that are implemented to modify the risk, such as prevent, detect, correct, or mitigate the risk7. Assessing risk with no controls in place can help to measure the inherent risk, but it does not show the impact or outcome of the risk treatment plans.
Providing peer benchmarking results is not the most helpful way, as it does not reflect the specific or unique risk profile of the organization. Peer benchmarking is the process ofcomparing the organization’s risk level and performance with its peers or competitors, based on a common set of criteria or indicators8. Providing peer benchmarking results can help to provide a reference or a standard for the risk posture, but it does not show the effect or result of the risk treatment plans.
Assessing risk with current controls in place is not the most helpful way, as it does not reflect the future or projected risk posture of the organization. Assessing risk with current controls in place can help to measure the current residual risk, but it does not show the expected or estimated residual risk at the end of the year.
References =
Residual Risk - CIO Wiki
Projected Residual Risk - CIO Wiki
Risk Treatment Plan - CIO Wiki
Risk Appetite and Tolerance - CIO Wiki
Risk Appetite: What It Is and Why It Matters - Gartner
Risk Monitoring and Review - The National Academies Press
Control - CIO Wiki
Benchmarking - CIO Wiki
[Risk Treatment - CIO Wiki]
