Forty-five percent of an organization's customer payments are submitted online. Eight percent of online payments are rejected. Executive management…

Residual risk is the risk remaining after management has taken action to alter the risk's likelihood or impact. The calculation is as follows:
1. Calculate the value of online payments: $1,250,000 45% = $562,500
2. Calculate the inherent risk (value of rejected payments): $562,500 8% = $45,000
3. Calculate the risk transferred to the contractor: $45,000 75% = $33,750
4. Calculate the residual risk (inherent risk - transferred risk): $45,000 - $33,750 = $11,250 The organization retains 25% of the inherent risk, which equals $11,250.

B. $25, 000: This figure is an arbitrary value and does not result from any logical calculation based on the data provided in the scenario.
C. $33, 750: This amount represents the risk that was transferred to the contractor, not the residual risk retained by the organization.
D. $45, 000: This amount represents the inherent risk, which is the total risk before any risk management response (i.e., outsourcing/transfer) is applied.

1. The Institute of Internal Auditors (IIA), International Professional Practices Framework (IPPF), "Standard 2120: Risk Management." The standard requires internal audit to evaluate the effectiveness of risk management processes. The glossary defines residual risk as "The portion of inherent risk that remains after management executes its risk responses." This question is a direct application of calculating that remaining portion.

2. COSO, Enterprise Risk Management—Integrating with Strategy and Performance, June 2017. Principle 14, "Implements Risk Responses," discusses how an organization selects and implements risk responses. Sharing risk (transfer) is a key response. The framework defines residual risk as the risk remaining after management has taken action to alter its severity (p. 7). The calculation in the question directly follows this principle.

3. Pickett, K. H. Spencer, The Internal Auditing Handbook, 3rd Edition, John Wiley & Sons, 2010. Chapter 10, "Risk-based internal auditing," discusses the relationship between inherent risk, control, and residual risk. It states, "Residual risk = Inherent risk – Control" (p. 215). In this scenario, the "control" is the risk transfer action.