What is residual risk?

Inherent risk is the level of exposure before any controls are applied; residual risk is what is left after them. Inherent risk helps you decide where to invest in controls, while residual risk tells you whether that investment was enough. It is the residual figure that gets compared with the organisation's risk appetite and tolerance to inform board and executive decisions.

If residual risk sits above appetite, a documented treatment plan is needed; if it sits below, the risk can be accepted and monitored. Both are usually measured as likelihood multiplied by impact, with the residual version adjusted for how effective the controls have proved to be under testing.

Some businesses stick to plain bands, low, medium or high, with a written reason for the rating. Others put numbers on it, scoring likelihood and impact and then estimating the loss in dollars. A simple, widely used formula is R = I x (1 - C), where I is the inherent risk score, C is control effectiveness on a scale of 0 to 1, and R is the residual score.

Worked through: an inherent score of 80 on a 100-point scale with controls that are 60 per cent effective gives a residual score of 32, which is then compared with the thresholds in the risk appetite matrix. Common pitfalls are overstating how well the controls work, lumping unlike risks together, and mixing scoring methods without writing down how they line up.

A lender's commercial loan portfolio carries inherent default risk driven by economic conditions. Credit policies, covenants, security and ongoing monitoring reduce that exposure; the residual risk is the loss still expected after the security is realised and the covenants enforced, and it feeds directly into credit decisioning. An insurer's residual risk is the exposure it retains after reinsurance; a project's is the remaining chance of slippage or cost overrun after stage gates and contingency budgets.

For a business assessing its own business risk, transferring exposure through insurance or contractual warranties and indemnities only works if the transfer is effective, so policy exclusions and the counterparty's credit strength matter. Finance and security arrangements change the picture too: secured borrowing alters collateral priorities and can affect operational resilience and recovery options.

Start by rating the inherent risk against a credible worst case. List the controls you rely on, who owns each one and when it was last tested. Rate how well they actually worked, using the test results rather than the intention. Then calculate the residual score, compare it with appetite, and decide whether to treat it, monitor it or accept it. Redo the assessment after an incident, a control failure, a change of supplier or a change in the rules.

Boards usually see it as a simple dashboard: each risk category, which way it is moving, and anything above appetite with an owner and a date. The measures tracked alongside it are the ones that move early, such as rising arrears, covenant breaches or falling security values. One risk register with an inherent column, a residual column and the testing evidence behind each rating is the source of truth.