Why is a risk mitigation plan incomplete if it focuses only on reducing likelihood but ignores impact, interdependencies, and residual risk?

Question

Answer

Because mitigation plans are mainly designed to satisfy external auditors

Answer

Because impact and residual risk are irrelevant once a control is implemented

Answer

Because a risk may still have severe consequences even if its probability is reduced

Answer

Because ignoring interdependencies can cause cascading failures across the organization

Crowdly