Explanation
Residual risk is the type of risk that remains after risk treatment has been applied1. Residual risk reflects the remaining exposure or uncertainty after taking into account existing controls.

Explanation
Control is not a set of systematic, deliberate, and actionable steps to manage risk, but rather a measure or action that modifies risk1. Process is a set of systematic, deliberate, and actionable steps to manage risk2.
Process involves establishing context, identifying risks, analyzing risks, evaluating risks, and treating risks.

Explanation
According to , page 9, one of the current trends in auditing, risk management and compliance is "shifting from auditing people to auditing processes". This means that internal auditors focus more on how well an organization's processes are designed and implemented to achieve its objectives and manage its risks.

Explanation
Risk management is a strategic management process . Risk management helps organizations to align their objectives, strategies, and actions with their external and internal environment.

Explanation
According to ISO31000 (2018), clause 5., establishing the context involves defining "the external and internal parameters to be taken into account when managing risk". The internal context includes "information systems, information flows and decision-making processes" among other factors.