Which of the following best describes 'residual risk' in the context of enterprise risk management?
-
A
The risk that remains after all possible mitigation strategies have been exhausted
-
B
The risk remaining after management applies controls and risk responses
-
C
The difference between inherent risk and regulatory capital requirements
-
D
Risk exposures that have not yet been identified by the ERM framework