An internal auditor is assessing the organization's risk management framework.

The appropriate formula to calculate residual risk is (Probability of events) × (Impacts). Residual risk is the risk that remains after controls are implemented to mitigate the inherent risk. It reflects the remaining exposure after considering the effectiveness of existing controls. This formula takes into account the likelihood of an event occurring and the potential impact if it does occur. References: IIA Practice Guide – Assessing the Adequacy of Risk Management Processes, COSO Framework