The risk mitigation plan is an essential component of risk management programs. It is essentially a
project plan designed to minimize or eliminate risks that are identified after risk assessment. Any
remaining risk after the risk mitigation process is concluded is referred to as residual risk. Residual risk is
determined according to security requirements and should always be documented in the risk mitigation
plan. Organizations usually accept a certain level of residual risk according to their risk appetite levels. If
the risk appetite is low for an organization, then the organization will implement more control, and the
residual risk levels will be lower compared to an organization with higher risk appetite. All final decisions
concerning residual risk and risk appetite should be made by management.