Residual Risk
Residual risk is the remaining level of risk after controls and mitigating measures have been applied. It represents the actual exposure an organization faces given its current control environment, and is compared against the organization's risk appetite to determine whether additional treatment is needed.
Residual risk is calculated by adjusting inherent risk based on the effectiveness of controls in place. If controls are fully effective, residual risk is significantly lower than inherent risk. If controls are partially effective or ineffective, residual risk may still exceed the organization's risk appetite, requiring additional treatment — more controls, risk transfer (insurance), risk avoidance, or documented risk acceptance. Monitoring residual risk over time reveals whether the control environment is improving or deteriorating.
Examples
- •A vendor's inherent data breach risk is high, but after implementing encryption, access controls, and monitoring, the residual risk is reduced to within the organization's risk appetite.
- •A payment system's inherent transaction error risk is medium, but after implementing automated reconciliation, the residual risk is low.
- •A third-party relationship's inherent concentration risk is high, but after diversifying to multiple vendors, the residual risk is moderate — still requiring monitoring.