Residual Risk

Residual risk exists as a concept because controls reduce risk but never erase it, and someone must consciously accept what remains. It is the honest answer to the board's question "so how exposed are we now?" — after the firewalls, the insurance, the second supplier. The dependent decision is acceptance: the board either accepts the residual level or funds further treatment. Confusing gross and residual figures makes that decision meaningless.

Residual levels are estimated by risk owners, challenged by the risk function, and compared with appetite in every risk report — typically quarterly. The register should show both figures side by side: gross risk, controls, residual risk. Example: the gross risk of a warehouse fire is assessed at USD 5 million of expected impact; after sprinklers, insurance and splitting stock across two sites the residual falls to USD 0.8 million — inside the appetite of USD 1 million, therefore accepted and documented. If residual exceeds appetite, the entry must carry a treatment action with a deadline.

The common error is mechanical discounting — subtracting two points from every gross score because "we have controls", without ever testing whether those controls operate. Untested controls mean the true residual equals the gross. Testing controls through exercises, and judging residual risk against appetite, is part of module M2 "From enterprise risk management to business resilience" in the ERGP programme.