How do you determine if residual risk is ALARP?

• A. Assess whether further risk reduction would be grossly disproportionate to the benefits and costs; document rationale
• B. Maximize risk reduction at all costs
• C. Compare against industry average only
• D. Apply only legal minimums

Answer: (A)

The idea being tested is ALARP—As Low As Reasonably Practicable. It’s about deciding when the remaining risk is low enough given the effort, time, and cost required to reduce it further. The best approach is to assess whether any further risk reduction would be grossly disproportionate to the benefits gained and the costs or effort required to achieve it, and to document the rationale. This means you stop when the extra safety gained is not worth the substantial resources or potential downsides of implementing more controls. It also emphasizes documenting why the decision is reasonable, so stakeholders can see the justification for accepting residual risk.

This isn’t about squeezing out every last bit of risk regardless of cost, nor about comparing to industry averages as the sole measure, nor about simply meeting legal minimums. Those approaches either push for excessive, impractical improvements or rely on external benchmarks or bare-minimum compliance without considering proportionality.