Residual Risk Scoring.

Hi All,

Can someone help me understand how residual score and calculated score are updated based on controls tied to risks? Is control compliance factor and risk factor used in this calculation ? Does this update even before controls are added to mitigate risk or its gets recalculated when controls are added for mitigation task for the specific risk ? If it does not calculate first time then what is the purpose of inheriting controls to risks ?

Thanks,

Neeraja.