Not all risks are possible to fully mitigate in every context, so you need to record and manage those residual risks. These are often put into a risk register along with the universe of risks that are mitigated. A better term to describe your log of residual risks might be Risk Inventory. Most organizations do not manage these risk inventories as well as they could. Before examining that, let’s look at what I think is a good, and simple, model of how to think about the overall risk process...| Risk and Cyber