By definition, residual risk includes new risks created by mitigation steps.

Yes, but it is easy to omit the new risks when considering the alternatives.

Jose
--
The monkey turns the crank and thinks he's making the music.
for Email, make the obvious change in the address.