Watch this video on YouTube
What is of greatest importance to the security manager when deciding whether to accept residual risk?