A risk practitioner has assessed the residual risk of a customer payments platform and must now evaluate it against the organisation's risk criteria so the risk committee can decide on a response. Which comparison BEST supports a sound risk evaluation at this stage?
- ACompare the inherent risk of the platform against the recorded inherent ratings of other in-scope systems to rank where it sits overall.
- BCompare the residual risk against the organisation's documented risk appetite and tolerance levels to judge whether the exposure is acceptable. Correct
- CCompare the cost of the controls already operating on the platform against the cost of the additional controls a vendor has proposed for it.
- DCompare the residual risk against the gross inherent risk recorded before any controls were credited to confirm that controls reduced it.
Why A is wrong: Ranking inherent risk across systems helps with scoping and prioritisation, but evaluation against criteria must use the residual figure that reflects the platform's actual current exposure.
Why B is correct: Risk evaluation tests the residual exposure against agreed criteria such as appetite and tolerance, which is what tells the committee whether the remaining risk needs a response.
Why C is wrong: Weighing control costs informs treatment selection later, but a cost comparison does not establish whether the residual risk itself sits inside or outside the organisation's criteria.
Why D is wrong: Showing that controls lowered the figure demonstrates control effect, yet a movement from inherent to residual says nothing about whether the result is acceptable against criteria.