Term

Residual risk

The risk that remains after controls are applied.

Residual risk is the level of exposure remaining once mitigating controls have been implemented. Organizations compare residual risk against risk appetite to decide whether further treatment is needed.

Residual risk, explained

No control removes risk entirely. Residual risk is the honest answer to the question: given everything we actually have in place today, how exposed are we? It is the number that decides whether a risk needs more work or can be accepted, which makes it the most consequential score in a risk register.

Three scores, three questions

Score, Question it answers, Changes when comparison
Score	Question it answers	Changes when
Inherent risk	How bad is this with no controls, or before considering them?	The threat landscape or asset value changes
Residual risk	How bad is it with the controls that are actually operating?	Controls are added, fail, or are tested
Target risk	Where do we want it to be after planned treatment?	Risk appetite or treatment plans change

A worked example

Take ransomware affecting a company's file servers, scored on a five-point scale for likelihood and impact, where the product gives a score out of 25 and the organization's appetite threshold is 8.

Stage, Controls considered, Likelihood, Impact, Score comparison
Stage	Controls considered	Likelihood	Impact	Score
Inherent	None	4	5	20
Residual today	Endpoint detection, patching, email filtering	3	5	15
Residual after plan	Plus immutable offline backups tested quarterly	3	2	6

Two lessons sit in this table. First, the existing controls reduced likelihood but not impact, so the residual score of 15 is still well above appetite. Second, the planned control does the opposite: tested backups barely change the chance of infection but sharply reduce the damage. Knowing which dimension a control affects keeps scoring grounded rather than optimistic.

Deciding what to do with it

Residual above appetite: further treatment is needed. Mitigate with more controls, transfer through insurance or contract, or avoid by stopping the activity.
Residual within appetite: the risk can be accepted, and the acceptance should be recorded.
Residual above appetite but no feasible treatment: escalate. Accepting it may be legitimate, but only by someone with authority to carry that level of exposure.

ISO/IEC 27001 clause 6.1.3 f) makes this explicit: risk owners must approve the risk treatment plan and accept the residual information security risks. An auditor will look for that approval and check that the person accepting is the one who owns the risk.

How residual scores go wrong

Crediting controls that are designed but not yet operating, or that have failed recent tests.
Reducing both likelihood and impact for a control that only affects one of them.
Scoring residual lower than target, which means either the target is wrong or the score is.
Never revisiting the score after an incident shows a control was weaker than assumed.
Accepting risk at team level when appetite has been set by the executive or board.

FAQ

Frequently asked questions

What is the difference between inherent and residual risk?

Inherent risk is the level of exposure before controls are taken into account. Residual risk is what remains after considering the controls actually in operation. The gap between them shows how much your controls are doing. A large gap on a critical risk also shows how much depends on those controls continuing to work.

Can residual risk ever be zero?

In practice, no. Controls reduce likelihood or impact but cannot eliminate every possibility of failure. The only way to remove a risk entirely is to avoid the activity that creates it, for example by not storing a type of data at all. Residual risk is therefore managed to an acceptable level, not removed.

Who should accept residual risk?

The risk owner, who should have the authority and accountability for the affected process or asset. ISO 27001 requires risk owners to accept residual information security risks. Many organizations also set thresholds so that higher residual risks must be accepted by senior leadership rather than an individual manager.

How is residual risk related to risk appetite?

Risk appetite is the amount of risk an organization is willing to take in pursuit of its objectives, often expressed as a score threshold. Residual risk is compared against it. Where residual risk exceeds appetite, more treatment is needed or a senior decision to accept is required. Where it falls within appetite, acceptance is usually routine.

Keep exploring