Residual risks are:

a) Risks that have been mitigated via some form of control.
b) Risks that still exist once a mitigation measure is in place.
c) Risks that are identified as part of risk identification.