When vulnerabilities have been controlled to the degree possible, there is often remaining risk that has not been completely removed, shifted, or planned for and is called .

When vulnerabilities have been controlled to the degree possible, there is often remaining risk that has not been completely removed, shifted, or planned for and is called residual risk.    

Explanation:

After, a certain degree of control is held over a given situation and most of the major factors are provided there basic requirements or solutions, there is however a certain chance of a risk that may arise due to some missing links or any weakness inside the current system which is often termed as the residual form of risk inside the management's terminology.