Explanation
According to ISO/IEC Guide73 (2009), clause B., residual risk is "the level of remaining after controls have been applied". It is sometimes called 'retained risk' because it represents the amount of risk that an organization decides to accept or retain after implementing its mitigation strategies 3.

Explanation
A governance, risk and compliance (GRC) framework is expected to improve efficiency by aligning strategy, processes, technology and people. GRC aims to integrate these elements to achieve organisational objectives while managing risks and complying with regulations.

Explanation
According to 3, clause 6.5., monitoring and review "is intended as a feedback loop for checking whether any change has occurred either internally or externally that may affect performance against objectives". It helps to ensure that the risk management process remains relevant and effective over time.

Explanation
Key risk indicators are metrics that provide information about potential changes in the level of risk exposure3.
They can help an organisation monitor and manage its risks more effectively. Key control indicators are metrics that measure the performance of internal controls4.

Explanation
Understanding the potential causes of risk events will primarily help an organisation to reduce the frequency of loss. This is because identifying and analysing the sources and drivers of risks can enable an organisation to implement preventive or mitigating measures.