A financial institution's information security officer is working with the risk management officer to determine what to do with the institution's residual risk...