Residual Risk
The level of risk that remains after treatment measures have been applied. Residual risk is what leadership formally accepts when they approve a risk treatment plan, acknowledging that no control eliminates risk entirely.
Why it matters
Every treated risk still carries residual exposure. A firewall reduces network risk but does not eliminate it. Encryption protects data at rest but keys can still be compromised. Understanding residual risk is critical because it is the actual risk your organization lives with. If residual risk exceeds your risk appetite, the treatment is insufficient and needs strengthening. Auditors verify that residual risk is formally assessed and accepted at the appropriate management level.
In practice
After implementing treatment measures, the risk is reassessed to determine the new likelihood and impact. The difference between inherent risk (before treatment) and residual risk (after treatment) demonstrates control value. If residual risk is still above appetite, additional controls or alternative treatment strategies are needed. In vucavoid, each risk assessment captures both inherent and residual ratings, with the treatment plan bridging the two. The assessment history shows how residual risk evolves over time.