Johnson has developed a list of risks for his organization, which he continuously maintains and updates with contributions from managers and senior leaders across the organization. What is the reason for doing this?

Enhancing risk awareness can be achieved by ensuring that leadership across an organization is informed about the risks faced by the organization and that they regularly update and offer insights on those risks. Inherent risk represents the risk that exists before implementing any controls, while residual risk is the risk that remains after implementing controls. Risk appetite denotes the degree of risk that an organization is willing to accept as part of its business operations.