Residual Risk

Overview

Residual risk reflects exposure that persists because controls are imperfect, threats change, uncertainty remains, or further reduction is impractical. It should be estimated after considering both the design and demonstrated operating effectiveness of risk treatments.

Low initial risk does not guarantee low residual risk if controls fail, while strong controls may materially change likelihood or impact. Measurement should include control dependencies, coverage gaps, exceptions, new risks introduced by treatment, and uncertainty in the assessment.

An authorized risk owner should compare residual exposure with appetite and tolerance, document evidence and assumptions, approve acceptance or further action, and establish monitoring. Material changes in assets, threats, controls, or business context require reassessment. Accepted exposure should remain visible in portfolio and executive reporting.

Residual risk is the risk remaining after selected controls, mitigations, transfers, or other treatments have been applied and evaluated. Decision-makers use Residual Risk to compare exposure with appetite and limits, select treatment, assign actions, monitor indicators, and accept documented residual risk when justified. Residual risk is what decision-makers actually retain after treatment, so it needs explicit ownership, evidence, approval, and continuing monitoring.

For Residual Risk, the assessment should evaluate the risk remaining after selected controls, mitigations, transfers, or other treatments have been applied and evaluated. The assessment record should separate observed evidence supporting the risk remaining after selected controls, mitigations, transfers, or other treatments have been applied and evaluated from assumptions, state the time horizon and existing controls, and identify who owns any remaining exposure. Monitoring should test whether the conditions described in the risk remaining after selected controls, mitigations, transfers, or other treatments have been applied and evaluated have changed enough to require a new rating, treatment, or approval.