Final answer:
The statement is false; controls are used to bring risks to an acceptable level, and residual risks can often remain after applying controls. The presence of such risks does not imply that controls are ineffective or should not be used.
Step-by-step explanation:
The statement is False. When dealing with control measures for risks, the goal is to reduce risk to an acceptable level, not necessarily to eliminate it completely. Controls are typically implemented to bring risks down to a level that is acceptable and manageable within the context of an organization's operations. There are cases where residual risks remain after controls are applied.
Residual risk is the risk that remains after all efforts to identify and eliminate risk have been applied. In practice, it's not always possible or cost-effective to reduce the risk to zero. But even when a control cannot further reduce a residual risk, it does not mean the control is useless or should not be used. Effective risk management often involves balancing the cost and benefit of controls, while ensuring that remaining risks are understood and accepted by management.