Incurred Residual Risk

This is the amount of remaining known risk after a decision is made to mitigate potential negative impact to our mission from identified vulnerabilities, threats or attack probabilities.

Examples of this are as follows.
      Management can decide to accept a certain level or risk. Other times there are threat factors and vulnerabilities which are not considered. Other instances may include an incorrect conclusion.