Which of the following BEST indicates the condition of a risk management program?

The best indicator of the condition of a risk management program is the amount of residual risk.

Residual risk is the risk that remains after the implementation of risk responses. Residual risk reflects

the effectiveness and efficiency of the risk management program in reducing the risk exposure to an

acceptable level, and in aligning the risk profile with the risk appetite and tolerance of the

enterprise. A low amount of residual risk indicates that the risk managementprogram is performing

well, and that the controls are adequate and appropriate. A high amount of residual risk indicates

that the risk management program is not functioning properly, and that the controls are insufficient

or ineffective. Reference = Risk and Information Systems Control Study Manual, 7th Edition, Chapter

1, Section 1.2.2, page 191