An approved control reduces risk but cannot eliminate it. What remains after implementation?

1. A guaranteed false positive
2. Residual risk
3. Inherent risk
4. A security exception automatically approved forever