How is residual risk used in the authorization decision?

• A. It controls access rights
• B. It has no practical use
• C. It determines the system name
• D. It informs the AO's decision on authorization

Answer: (D)

Residual risk is the amount of risk that remains after security controls and mitigations have been put in place. In the authorization process, the Authorizing Official uses this residual risk to decide whether the system's risk level is acceptable given the mission, regulatory requirements, and tolerance for potential impact. The key idea is that controls reduce risk, but never eliminate it entirely; the authorization decision hinges on whether what’s left is within what the organization is willing to accept.

If the residual risk is within tolerance, authorization can proceed (often with stated conditions or risk mitigation plans). If it’s too high, the decision may be to delay authorization, require additional controls, or deny operation. This makes residual risk the central input to the AO’s risk-based judgment about whether to authorize the system to operate.

Residual risk is not about naming the system or simply granting access rights; it’s about the overall risk level remaining after controls and whether that level fits the organization’s risk posture. It does have practical use: it guides the formal authorization decision and any follow-up risk management actions.