Plain definition
Residual risk is the exposure that remains after considering the controls, safeguards, or responses in place. It is the risk management and the board must be willing to accept, reduce further, transfer, avoid, or monitor. Effective controls may lower likelihood, impact, or both, but they rarely remove all uncertainty.
Residual risk should be assessed using evidence about actual control operation, not by assuming that a documented policy works. It differs from inherent risk, which considers the exposure before giving effect to controls.
Illustrative example
Suppose a manufacturer depends on one specialist component supplier. Management identifies high inherent risk because an interruption could stop production. It introduces safety stock, a secondary supplier qualification plan, and weekly monitoring of the primary supplier’s delivery performance. After reviewing the time needed to qualify the second supplier and the current stock coverage, the operations director concludes that a meaningful interruption risk still remains.
The director brings that residual risk to the executive team, which decides whether to hold more inventory, accept the remaining risk for the season, or change customer commitments. Calling the controls “complete” would conceal the decision the company still has to make.
A residual-risk judgment should state the assumptions and limitations of the controls considered, especially where evidence is incomplete or conditions are changing.
Why it matters
It keeps leadership focused on the exposure that remains after action, rather than reporting only the controls that were installed.
It supports clear decisions about further investment, risk transfer, contingency plans, or informed acceptance.
Practical consequence
For a major risk, document the inherent exposure, each response, evidence that it operates, and what could still go wrong.
Compare the remaining exposure with the organisation’s appetite and escalation thresholds, then review it when control performance or external conditions change.