When vulnerabilities have been controlled to the degree possible, there is often remaining risk that has not been completely removed, shifted, or planned for and is called .

When vulnerabilities have been controlled to the degree possible, there is often remaining risk that has not been completely removed, shifted, or planned for and is called residual risk.    

Explanation:

After, a certain degree of control is held over a given situation and most of the major factors are provided there basic requirements or solutions, there is however a certain chance of a risk that may arise due to some missing links or any weakness inside the current system which is often termed as the residual form of risk inside the management's terminology.

Ibelieve that the answer is (a).