Which statement best describes residual risk in a hazard log?

• A. The remaining risk after controls are applied
• B. The initial risk before controls
• C. The risk of data privacy
• D. The risk of equipment failure only

Answer: (A)

Residual risk is the remaining risk after controls are applied. In a hazard log, you identify hazards and assess how risky they are, then implement controls to reduce that risk. The log then records the remaining level of risk after those controls, which is the residual risk you must monitor and decide whether further mitigation is needed. This concept matters because even with safeguards in place, some risk often persists, and that persisting risk drives decisions about additional controls or acceptance criteria. The other statements describe different ideas: the initial risk before controls (inherent risk), a domain-specific concern like data privacy, or a narrow focus such as equipment failure only.