What it means
Separating the two shows how much risk reduction the control environment is expected to provide and whether the remaining exposure fits organizational tolerance.
Why it matters
The distinction supports better treatment decisions, control investment, and acceptance records. It also exposes situations where controls exist on paper but do not materially reduce risk.
Practical focus
- Define the scenario and assumptions before scoring
- Evaluate control design and operating effectiveness
- Record uncertainty and evidence quality
- Compare residual risk with tolerance and acceptance authority
Common mistakes
- Subtracting control counts from a risk score
- Assuming a policy automatically reduces exposure
- Ignoring dependencies and compensating controls
- Reporting residual risk without naming the decision owner
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: