Explanation
According to 1, there are four types of potential risk strategies for threats: avoid (eliminate or change), transfer (share or outsource), mitigate (reduce or control), accept (retain or monitor). There are also four types of potential risk strategies for opportunities: exploit (ensure or enhance), share (allocate or collaborate), enhance (increase or maximize), accept (acknowledge or watch).

Explanation
Residual risk is the type of risk that remains after risk treatment has been applied1. Residual risk reflects the remaining exposure or uncertainty after taking into account existing controls.

Explanation
According to 3, page 6, one of the current trends in auditing, risk management and compliance is "moving from a back-office function providing lagging indicators about risk (e.g., audit findings) to a front-office function providing leading indicators about risk (e.g., key risk indicators)".

Explanation
According to , page 4, a holistic approach to risk management is "one that considers all sources and types of risks across all organizational units and activities". It aims to integrate governance, strategy, performance, culture and ethics into a coherent framework for managing uncertainty 2.

Explanation
ISO uses the concept of uncertainty as the driver and rationale for risk management. Uncertainty refers to the state of having incomplete knowledge or understanding about something that can affect an organization's objectives.