.png)
Residual risk is an inevitable part of the risk management process. Even with the most comprehensive mitigation efforts, some level of risk remains—this is known as residual risk. Recognising, measuring, and managing this remaining risk is essential to making better strategic decisions and fostering resilience.
In this article, we’ll explore the difference between inherent and residual risk, why it matters, and the tools and strategies you can use to manage it effectively. Drawing on principles of agile risk management and psychological safety, we’ll show you how it fits into a broader risk culture. Whether you’re a business leader or an individual looking to improve decision-making, this guide provides actionable insights to help you navigate residual risk.
TABLE OF CONTENTS
Understanding Residual Risk
Residual risk is like rainwater left behind after you’ve covered your roof with tarps during a storm. Even with precautions, some risk will always remain. It’s an inherent element of the risk management lifecycle and reflects the reality that no system, process, or plan is entirely foolproof.
To fully understand residual risk, it’s essential to contrast it with inherent risk.
The Difference Between Inherent Risk and Residual Risk
What is Inherent Risk?
Inherent risk is the amount of risk you face before doing anything to reduce it. Think of it as the 'raw' risk of a situation. It represents the "raw" or "natural" risk associated with an activity, assuming no safeguards are in place.
Characteristics of Inherent Risk:
Represents the full exposure to risk without controls.
Often higher than acceptable levels in most contexts.
Highlights the need for mitigation or control measures.
Â
Examples of Inherent Risk:
A bank’s exposure to cybersecurity threats before implementing firewalls and encryption.
The risk of a natural disaster impacting supply chain operations without contingency plans in place.
What is Residual Risk?
It, on the other hand, is the level of risk that remains after mitigation measures and controls have been implemented. It reflects the "leftover" risk that an organisation or individual must manage and monitor.
Characteristics of Residual Risk:
Takes into account the effectiveness of existing controls.
Typically lower than inherent risk but still requires oversight.
Represents the risk that must be tolerated, transferred, or further mitigated if necessary.
Examples of Residual Risk:
After installing firewalls and encryption, a company still faces residual risks like phishing attacks or insider threats.
Despite regular exercise and a balanced diet, an individual remains at risk of health issues due to genetic factors.
Key Differences Between Inherent and Residual Risk
Aspect | Inherent Risk | Residual Risk |
Definition | Risk before any mitigation measures are applied. | Risk that remains after mitigation measures. |
Purpose | Highlights the full extent of risk exposure. | Focuses on the effectiveness of controls and what remains. |
Mitigation | Not yet mitigated; exists in its raw form. | Mitigated to an acceptable or tolerable level. |
Evaluation | Helps identify where controls are needed. | Helps assess the adequacy and effectiveness of controls. |
Example | Risk of a data breach without any IT controls. | Risk of a breach after firewalls and encryption are in place. |
Why Understanding and Managing Residual Risk Matters
Both inherent risk and residual risk are critical components of an enterprise risk management framework, and understanding their interplay is essential for effective decision-making.
Inherent Risk: Helps organisations prioritise which risks require immediate attention and mitigation measures.
Residual Risk: Highlights the impact of risk controls and identifies the risks that remain, requiring ongoing monitoring or further action.
Failing to adequately address residual risk can lead to several issues:
Overconfidence in Controls: Believing that mitigation measures eliminate all risk creates blind spots and fosters complacency.
Unpreparedness for Unexpected Events: Ignoring residual risks leaves organisations vulnerable to surprises, as there are no contingency plans for the "leftover" risks.
Proactively managing residual risk ensures:
A Holistic Risk Management Framework: Residual risk management fills the gap between mitigation and operational readiness, ensuring risks remain within acceptable levels.
Enhanced Resilience: Continuous monitoring and adjustment of residual risks build preparedness for unforeseen challenges.
Informed Decision-Making: By identifying and quantifying residual risks, organisations can allocate resources strategically and align risk tolerance with business goals.
Incorporating residual risk management into strategies like the Three Lines Model and agile risk management supports a culture of accountability, adaptability, and continuous improvement.
Tools for Measuring Residual Risk
Effectively measuring residual risk is vital for organisations and individuals to understand what risks remain and whether they fall within acceptable thresholds. Below are three practical tools to measure and monitor it, along with actionable steps for implementation and a practical risk calculator example you can use.
Residual Risk Calculators
Use a residual risk calculator to measure how much risk is left after taking safety steps. For example, if your controls reduce risk by 70%, the calculator helps you see what’s still at stake. By assigning values to factors like likelihood and impact, these calculators help derive a risk score formula to evaluate residual risks systematically.
Risk Score Formula:
Residual risk can be typically calculated using this formula (this is an example):
Residual Risk Score=(Inherent Risk Score)×(1−Control Effectiveness)
Where:
Inherent Risk Score = Likelihood × Impact (before applying controls)
Control Effectiveness = Percentage (0 to 1) of how well the implemented measures reduce the inherent risk.
Note: Control effectiveness measures how well risk-reduction efforts, like security systems or policies, work. It’s expressed as a percentage, where 100% means the control fully eliminates the risk.
Practical Example:
Imagine a company evaluating its residual cybersecurity risks:
Inherent Risk:
Likelihood = 0.8 (80%), Impact = 10 (on a scale of 1–10).
Inherent Risk Score=0.8×10=8
Control Effectiveness:
70% (firewalls, encryption, etc. mitigate 70% of risks).
Residual Risk Score=8×(1−0.7)=8×0.3=2.
This score of 2.4 indicates that some risk remains and must be monitored or further mitigated.
Risk Heat Maps
Risk heat maps visually represent the residual risks, enabling organisations to prioritise and address those exceeding acceptable thresholds. A heat map is a visual tool that helps you rank risks. It uses a grid to show how likely a risk is to happen (likelihood) and how serious its effects would be (impact). Risks are color-coded (e.g., green for low risk, red for high risk) to help prioritise.
How to Create a Heat Map:
List Residual Risks: Include all risks remaining after controls, along with their likelihood and impact scores.
Assign Values: Score each residual risk (e.g., 1–5 for likelihood and 1–5 for impact).
Plot on the Matrix:
X-axis: Likelihood
Y-axis: Impact
Colour Code:
Green: Acceptable risk
Yellow: Moderate risk, monitor closely.
Red: High-priority risk requires immediate attention.
Application Example:
A financial services firm uses a heat map to assess residual regulatory risks:
Risk 1: Non-compliance fines (Likelihood = 4, Impact = 5) =Â Red Zone.
Risk 2: Customer complaints (Likelihood = 3, Impact = 2) =Â Yellow Zone.
The firm identifies high-priority risks (red zone) and allocates resources to address them first.
Key Performance Indicators (KPIs)
KPIs track residual risk over time, ensuring controls remain effective and risks stay within acceptable thresholds. Effective KPIs should be specific, measurable, and aligned with organisational goals.
Examples of Residual Risk KPIs:
Cybersecurity: Frequency of data breaches after firewall implementation.
Financial Losses: Instances where losses exceed predefined risk-tolerant thresholds.
Operational Risk: Number of incidents reported after process improvements.
Compliance Risk: Penalty amounts, or regulatory warnings received.
Practical Steps to Define KPIs:
Identify Key Risks: Focus on residual risks critical to your operations.
Set Thresholds: Define acceptable levels for these risks (e.g., no more than 3 data breaches per quarter).
Monitor Regularly: Use tools like dashboards or spreadsheets to track KPI performance.
Act on Deviations: Investigate and address instances where KPIs exceed tolerable levels.
Practical Residual Risk Calculator
To make this actionable, here’s a simple Calculator you can implement in Excel, Google Sheets, or even embed as a downloadable tool:
Risk ID | Risk Description | Likelihood (1–5) | Impact (1–5) | Inherent Risk Score | Control Effectiveness (%) | Residual Risk Score |
1 | Data breach risk | 4 | 5 | =Likelihood × Impact | 70% | =Inherent × (1 - CE) |
2 | Non-compliance fines | 3 | 4 | =Likelihood × Impact | 60% | =Inherent × (1 - CE) |
How to Use:
Input Likelihood and Impact values (1–5 scale).
Calculate the Inherent Risk Score (Likelihood × Impact).
Input the Control Effectiveness percentage (e.g., 70% = 0.7).
Calculate the Residual Risk Score using the formula:
Residual Risk Score = Inherent Risk Score × (1−Control Effectiveness)
You can expand this table to include risk scoring thresholds (e.g., residual scores >15 require action).
Practical Strategies for Managing Residual Risk
Scenario Planning
Developing contingency plans for potential scenarios ensures preparedness for residual risks that exceed tolerable levels. Scenario planning is a critical risk analysis tool and involves identifying possible adverse events, evaluating their potential impact, and creating actionable responses to mitigate disruptions.
Example: Cyberattack Response for a Financial Services Firm
A global financial services firm has implemented robust cybersecurity measures, such as firewalls, encryption, and employee training. However, residual risks like phishing attacks, ransomware, and insider threats remain.
Identifying Scenarios:
A ransomware attack encrypts critical customer data, demanding payment for decryption keys.
An insider threat causes unauthorised access to sensitive information.
Contingency Plans:
Incident Response Teams: Establish a dedicated team trained to handle cybersecurity breaches, including IT specialists, legal advisors, and communication experts.
Data Backup Protocols: Schedule regular backups of critical data on secured servers to minimise data loss during an attack.
Communication Plans: Develop a strategy to notify stakeholders, including customers and regulators, in case of a breach.
Third-Party Vendor Readiness: Partner with a cybersecurity firm to provide rapid support for breach containment and recovery.
Outcome: When a ransomware attack occurs, the company executes its contingency plan:
The incident response team isolates affected systems to prevent the spread of malware.
Encrypted data is restored using recent backups, avoiding the need to pay the ransom.
Stakeholders are informed promptly, ensuring transparency and compliance with regulations.
This proactive approach ensures minimal disruption to operations, protects customer trust, and reduces financial losses.
Key Takeaways for Scenario Planning:
Identify likely scenarios based on residual risks.
Develop action plans for the most critical risks.
Test and refine contingency plans through simulations or tabletop exercises.
Regularly update plans to account for new risks and evolving business conditions.
Periodic Reviews
Regularly reassessing residual risks is crucial to ensure the risk profile remains accurate and relevant as conditions change. Factors such as evolving business environments, regulatory updates, technological advancements, or new threats can render previous risk assessments outdated. Periodic reviews help identify emerging residual risks, evaluate the effectiveness of controls, and refine mitigation strategies.
Implementation Steps:
1.Define Review Intervals: Schedule semi-annual or quarterly reviews, depending on the volatility of your environment or industry (e.g., technology firms might need more frequent reviews due to rapid innovation).
2.Assemble a Risk Review Team: Include representatives from key functions, such as operations, compliance, IT, and finance, to ensure a holistic view of residual risks.
3. Use Tools to Reassess Risks:
Update risk heat maps to reflect the likelihood and impact of residual risks in light of new data.
Recalculate residual risk scores to account for changes in control effectiveness or newly identified risks.
4. Document and Report Findings:
Record changes in residual risks and document adjustments to mitigation measures.
Share results with senior leadership and stakeholders to ensure alignment on risk priorities.
5. Integrate Findings into Planning:
Use the updated risk profile to inform strategic planning, resource allocation, and contingency planning.
Example: Supply Chain Residual Risk in Manufacturing
Â
A manufacturing company reviews its supply chain risks every six months. Initially, the company identified residual risks of delays from secondary suppliers due to geopolitical instability. However, during a review, the team notices increasing likelihood of disruptions due to new environmental regulations affecting primary suppliers.
Â
Actions Taken:
Â
Shifted focus to diversifying suppliers to mitigate over-reliance on any single region.
Updated contingency plans to include a rapid procurement process from alternative suppliers.
Implemented real-time monitoring tools to track supply chain risks dynamically.
Â
Outcome: The company stays ahead of supply chain disruptions, avoiding production delays and financial losses.
Adaptive Risk Tolerance
Risk tolerance is not static. Organisations and individuals should adjust their acceptable risk levels based on changes in growth stage, objectives, market conditions, or personal circumstances. Adapting risk tolerance ensures alignment with evolving priorities and a more sustainable approach to risk management.
Â
Steps to Adapt Risk Tolerance:
Assess Current Context:
For organisations: Evaluate current business objectives, financial health, and market position.
For individuals: Consider life changes, financial goals, or external circumstances.
Define Risk Tolerance Thresholds:
Determine what level of risk is acceptable under current conditions (e.g., financial risk, operational risk, or reputational risk).
Reassess Regularly:
Use periodic reviews (as outlined above) to ensure thresholds remain aligned with changing conditions.
Update Controls and Processes:
Tighten or relax controls to match new risk tolerance levels.
Communicate Changes:
For organisations: Inform stakeholders and employees of any changes to risk tolerance policies.
For individuals: Adjust personal financial or life planning strategies accordingly.
Example: Evolving Financial Risk Tolerance in a Startup
Â
A sustainable energy startup begins with a high-risk tolerance as it focuses on rapid growth and market entry. It takes on higher financial risks, including operating at a loss for the first two years while investing heavily in product development and customer acquisition.
Adjustment as the Business Matures:
Â
After three years, the startup achieves profitability and shifts its focus to stability and scalability.
Â
Actions Taken:
Â
Reduces reliance on high-interest loans and focuses on cost efficiency.
Implements stricter financial controls, such as expense thresholds and tighter budgeting.
Allocates more resources to risk mitigation strategies like product diversification and regulatory compliance.
Â
Outcome: The company’s adjusted risk tolerance balances growth with long-term sustainability, ensuring resilience against market downturns or competition.
Â
Individual Example: Personal Financial Risk Tolerance
Â
An individual in their early career may have a high tolerance for financial risk, investing in volatile assets like cryptocurrency or startups. As they approach retirement, they shift toward a low-risk tolerance, favouring stable investments like bonds and diversified mutual funds.
Case Studies: Managing Residual Risk in Action
Case studies offer practical insights into how residual risk can be identified, measured, and managed across industries. Here are five examples spanning diverse contexts to illustrate how residual risk management is applied:
1.    Financial Institution: Regulatory Risk
A global bank revisits its residual risks related to regulatory fines. Despite implementing compliance frameworks, ongoing changes in the regulatory landscape leave gaps in its defences.
Risk Identified: The potential for fines due to non-compliance with evolving anti-money laundering (AML) regulations.
Solution:
The bank conducts periodic reviews of regulatory requirements.
It uses a risk heat map to visualise high-priority compliance gaps.
Scenario planning is employed to anticipate the impact of fines and litigation on operations.
Outcome: The bank enhances its monitoring tools and builds a proactive compliance strategy, reducing exposure to fines while improving stakeholder confidence.
2.    Family Health Strategy: Long-Term Risk
A family addresses residual health risks as part of their long-term strategy. Despite regular exercise, balanced diets, and routine check-ups, risks like genetic predispositions remain.
Risk Identified: Health risks due to hereditary conditions such as diabetes or cardiovascular disease.
Solution:
The family uses KPIs such as annual cholesterol levels and glucose monitoring to track residual risks over time.
Contingency plans are developed, including early access to specialist healthcare and financial planning for medical expenses.
Outcome: Proactive health management minimises the likelihood of severe outcomes while preparing the family for unexpected medical costs.
3.    Manufacturing Industry: Operational Risk
A manufacturing company introduces automation to improve production efficiency but recognises residual risks related to machinery breakdowns and supply chain delays.
Risk Identified: Downtime due to equipment failures and supplier disruptions that could delay product delivery.
Solution:
The company implements predictive maintenance software to monitor equipment performance and flag early warning signs of failures.
Scenario planning identifies alternative suppliers to ensure business continuity in case of primary supplier disruptions.
KPIs such as "mean time between failures" (MTBF) are tracked to monitor residual risk levels.
Outcome: Production efficiency improves, and the company mitigates delivery delays by securing alternative suppliers.
4.    Healthcare Sector: Cybersecurity Risk
A hospital adopts electronic medical records (EMRs) to improve patient care but acknowledges residual cybersecurity risks despite deploying firewalls, encryption, and employee training programs.
Risk Identified: The risk of ransomware attacks targeting patient data or insider threats compromising privacy.
Solution:
The hospital conducts regular vulnerability assessments and uses a residual risk calculator to quantify potential data breach impacts.
Risk heat maps highlight areas where residual risks exceed tolerable thresholds.
Scenario planning involves developing response protocols for ransomware attacks, including a clear chain of command and incident recovery steps.
Outcome: The hospital reduces downtime during cyber incidents, strengthens its data protection practices, and builds patient trust in its systems.
5.    Startup Company: Financial Risk
A startup focused on developing sustainable energy solutions faces residual financial risks even after securing funding and conducting market research.
Risk Identified: Insufficient revenue generation in the first 18 months due to slower-than-expected market adoption of its product.
Solution:
The startup uses KPIs such as "monthly recurring revenue" (MRR) and customer acquisition costs to monitor residual risks.
Scenario planning includes contingency measures such as cutting discretionary expenses or extending funding through bridge loans.
The founders adopt adaptive risk tolerance, accepting higher financial risks during the growth phase while planning for tighter controls post-breakthrough.
Outcome: The startup builds a resilient financial model, enabling it to survive early challenges and secure long-term growth.
How to Incorporate Residual Risk Management into Decision-Making
Integrating residual risk into decision frameworks enhances both strategic and operational resilience. Here’s a step-by-step guide:
Identify Risks:Â List risks remaining after mitigation.
Prioritise Using SWOT Analysis:Â Assess strengths, weaknesses, opportunities, and threats in the context of the risk.
Conduct Cost-Benefit Analysis:Â Weigh the cost of additional controls against the potential impact of such risks.
Embed in Decision Processes:Â Include residual risk as a standing agenda item in strategic meetings or personal decision-making.
Conclusion
Residual risk is an unavoidable reality in risk management. However, it’s not a weakness—it’s an opportunity to strengthen resilience and enhance preparedness. By using tools like risk calculators, heat maps, and KPIs, combined with strategies such as scenario planning and periodic reviews, you can effectively manage residual risk.
The key is to remain proactive and adaptive. As your organisation or personal circumstances evolve, so too must your approach to residual risk. Remember, continuous monitoring and an agile mindset are essential for staying ahead.
FAQs
1. What is residual risk?
It is the level of risk that remains after all mitigation measures and controls have been applied. It represents the "leftover" or unavoidable risks that organisations or individuals must monitor and manage to stay prepared for unexpected events.
2. How is residual risk different from inherent risk?
Inherent risk is the raw risk present before any controls or mitigation measures are applied. It, on the other hand, is the risk that remains after those controls are implemented.
Example:
Inherent Risk: Risk of a data breach before installing firewalls.
Residual Risk: Risk of phishing attacks after firewalls are in place.
3. Why is managing residual risk important?
Managing it ensures:
Preparedness for unexpected events.
Continuous improvement of risk management systems.
Avoidance of overconfidence in mitigation measures.
Resilience against disruptions and improved decision-making.
Ignoring such risks can lead to blind spots, unpreparedness, and potential financial, reputational, or operational losses.
4. How do you calculate residual risk?
It can be calculated using the following formula:
Residual Risk Score=Inherent Risk Score×(1−Control Effectiveness)
Where:
Inherent Risk Score = Likelihood × Impact.
Control Effectiveness = Percentage (0–1) of how well the controls reduce risk.
Example: If the inherent risk score is 8 (Likelihood = 0.8, Impact = 10) and control effectiveness is 70% (0.7):
Residual Risk Score=8×(1−0.7)=2.4
5. What tools can be used to measure residual risk?
You can use tools such as:
Residual Risk Calculators: Quantify risk using likelihood, impact, and control effectiveness.
Risk Heat Maps: Visualise and prioritise risks based on their likelihood and impact.
Key Performance Indicators (KPIs): Track risk-related metrics over time, such as data breaches or financial losses.
6. What is the role of periodic reviews in managing residual risk?
Periodic reviews help ensure the residual risk profile remains current and accurate in light of new data, regulations, or business changes. By reassessing risks regularly, organisations can:
Update mitigation measures.
Identify new risks.
Refine contingency plans.
Maintain alignment with strategic goals.
7. How can scenario planning help manage residual risk?
Scenario planning prepares organisations for unexpected events by:
Identifying potential risks that exceed tolerable levels.
Developing actionable contingency plans.
Testing responses to adverse events through simulations or exercises. For example, a company might simulate a ransomware attack to ensure its incident response plan is effective.
8. What is adaptive risk tolerance, and why is it important?
Adaptive risk tolerance means adjusting the acceptable level of residual risk as circumstances change, such as organisational growth, market conditions, or personal life events. It ensures that risk management strategies remain sustainable and aligned with evolving priorities.
Example:
A startup might accept higher financial risks during its growth phase.
A healthcare organisation may lower its risk tolerance for patient data breaches as regulations tighten.
9. How can KPIs be used to monitor residual risk?
Key Performance Indicators (KPIs) allow organisations to track the effectiveness of controls and monitor risk levels over time. Examples include:
Cybersecurity: Number of data breaches after implementing firewalls.
Compliance: Amount of fines incurred due to regulatory violations.
Operations: Frequency of equipment breakdowns after maintenance programs.
10. Can residual risk ever be fully eliminated?
No, it cannot be entirely eliminated because no mitigation strategy is 100% effective. However, it can be minimised and kept within tolerable levels through continuous monitoring, periodic reviews, and proactive planning.
11. What industries are most impacted by residual risk?
It affects all industries, but its impact varies depending on the nature of the business. For example:
Financial Services: Regulatory and cybersecurity risks.
Healthcare: Patient data breaches and operational risks.
Manufacturing: Supply chain disruptions and equipment failures.
Startups: Financial risks and market adoption uncertainties.
12. How can individuals manage residual risk in personal decision-making?
Individuals can manage it by:
Monitoring health risks with regular check-ups and lifestyle adjustments.
Reviewing personal finances and diversifying investments.
Preparing contingency plans for life events, such as saving for emergencies or securing insurance.
13. How does residual risk fit into the Three Lines Model?
It aligns with the Three Lines Model by emphasising the importance of ongoing risk oversight:
First Line: Operational teams identify and manage residual risks in their processes.
Second Line: Risk management and compliance teams assess and monitor these risks.
Third Line: Internal auditors ensure that controls and monitoring mechanisms are effective.
14. How do organisations set tolerable levels for residual risk?
Organisations determine tolerable risk levels based on factors like:
Industry standards and regulations.
Stakeholder expectations.
Strategic objectives and resources. Once tolerable levels are defined, they guide decision-making and resource allocation to ensure residual risks remain within acceptable thresholds.
15. What happens if these risks are ignored?
Ignoring it can lead to:
Overconfidence in mitigated risks.
Lack of contingency plans for unexpected events.
Financial, reputational, or operational losses.
Regulatory penalties for non-compliance.