This is a computer science problem.

What does residual risk mean?

The security risk that remains after controls have been implemented

Weakness of an assets which can be exploited by a threat

Risk that remains after risk assessment has has been performed

A security risk intrinsic to an asset being audited, where no mitigation has taken place