Residual risk: definition
Residual risk is the level of risk that remains after treatment measures have been applied. It is never zero: it has to be measured, compared with the level the company is prepared to accept and approved by whoever owns it.
In short
Risk analysis starts from inherent risk: how likely a threat is and how much damage it would do, without considering the countermeasures (or before adding them). Then you decide how to treat it. What remains after treatment is the residual risk. Comparing the two figures shows how well the measures you adopted have worked.
How it works
With a simple, widely used method, risk is the product of likelihood and impact, each on a scale from 1 to 5: the result ranges from 1 to 25 and is divided into bands. ISO/IEC 27005 provides four treatment options:
- modify the risk with controls that reduce likelihood or impact;
- avoid it, by giving up the activity that creates it;
- share it, for example through insurance or by entrusting the activity to a supplier;
- retain it, accepting it knowingly.
ISO/IEC 27001 (clause 6.1.3) requires the risk owners to approve the treatment plan and formally accept the residual risks. A residual risk above the acceptance threshold set by the company calls for further measures, or an explicit decision by management.
Why it matters
Auditors ask precisely for the comparison between inherent and residual risk, because it shows that the analysis is not just a paper exercise. And no measure makes a risk disappear: anyone who claims there is no risk left has not understood the problem. Writing down how much risk remains, and who accepted it, protects the company and the people who make the decisions. The choices are reflected in the Statement of Applicability and must be reviewed in every cycle, because threats and systems change.
Example
Threat: ransomware on the file server. Inherent risk: likelihood 4, impact 5, total 20, very high band. Treatment: MFA on remote access, monthly patch management, daily backup with an isolated copy and a quarterly restore test. Residual risk: likelihood 2 (the attack is still possible), impact 3 (the data can be recovered, but downtime and possible data theft remain), total 6, medium band. The risk owner, the finance director, accepts it, and the decision is dated and reviewed the following year.
If, a year later, new attack techniques appear against the backup software in use, the likelihood has to be reassessed: residual risk is not a fixed number, but the result of an assessment that has to be repeated.
Related terms
Where you find it in Dottor Box
Risk Assessment calculates inherent risk as likelihood times impact, from 1 to 25 across five bands, and, after the treatment plan, the residual risk, with an owner for every risk. Each analysis cycle is closed and kept as a dated snapshot, reused as evidence in the Compliance module.
Risk Assessment
Risk analysis based on ISO/IEC 27005, with a treatment plan and residual risk.
Learn more GovernCompliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn more ComplianceISO/IEC 27001
The information security management system, from the SoA to the audit.
Learn more