What is residual risk?
Residual risk is the part of a risk that an organisation knowingly carries after its risk treatment. Under BSI Standard 200-3, chapter 6.1, risk classification and treatment are repeated until the organisation's acceptance criteria are met; the remaining risk is then put to management for approval. In ISO/IEC 27001, the risk owners approve the treatment plan and accept the remaining risks under clause 6.1.3.
A planned control describes an expected improvement. It does not prove that the risk has already fallen today.
Three states: inherent, current, residual
| State | Controls taken into account | What it is used for |
|---|---|---|
| Inherent risk (gross risk) | none | shows what the existing controls achieve |
| Current risk (net risk) | those effective today | steering and reporting |
| Residual risk | additionally the agreed, still planned ones | approval and whether the effort pays off |
Some risk policies already call the current net risk "residual risk". Define which state you mean and use it the same way in every report. More on the distinction in inherent risk.
Worked example: two controls, two effects
Fictional example: accidentally deleted customer data interrupts a service and causes recovery costs. Assume at most one such event in the coming year. The figures in this example are invented for illustration.
| State | Annual likelihood | Loss per event | Expected annual loss |
|---|---|---|---|
| inherent, without the two controls | 20% | €100,000 | €20,000 |
| current: a restorable backup lowers the loss | 20% | €30,000 | €6,000 |
| residual: tighter deletion rights also lower the likelihood | 10% | €30,000 | €3,000 |
Expected annual loss = annual likelihood × loss per event.
The backup changes the loss, not the event. The tighter rights in access control change the likelihood. A single percentage for the "effectiveness" of both controls would hide that difference.
Does the planned control pay off?
The planned control lowers the expected annual loss from €6,000 to €3,000, a reduction of €3,000. If running it costs €2,000 a year, a benefit of €1,000 remains.
If it only lowers the likelihood to 15% instead of 10%, the expected loss is €4,500. The reduction of €1,500 is then €500 below the cost. The break-even point is about 13.3%: (€6,000 − €2,000) ÷ €30,000. Decision-makers therefore judge whether the tighter deletion rights reliably push the likelihood below 13.3%.
Justify every assumption: incident history and the volume of the affected activity for likelihood, downtime and recovery effort for the loss, tested for example in a recovery exercise. Where data is thin, calculate a range. Expected loss is an average, not a ceiling for a single incident.
How is residual risk accepted?
Residual risk is accepted when the responsible body has approved it and the decision is documented. That takes four items:
- a named risk owner with authority for the affected area;
- a threshold rule stating from which risk level senior management decides;
- a justification with the assumptions that applied at the time;
- a date or trigger for review.
BSI Standard 200-3 gives three example reasons for accepting higher risks as well:
- The threat only causes harm under very specific conditions.
- No effective countermeasures are currently known.
- The effort and cost of effective countermeasures exceed the value to be protected.
For a German management board, the documented approval also shows that it decided on the basis of adequate information (§ 93(1) sentence 2 AktG). For managing directors of a GmbH, § 43(1) GmbHG requires the care of a prudent businessperson.
Reassess when an assumption changes: the threat situation, the legal situation, a compensating control that falls away, an incident in a comparable area, or the system itself. Once a control is completed, check that it works before the planned reduction counts as achieved.
Three figures per risk assessment in Rizzqo
In Rizzqo every risk assessment carries inherent, current and residual risk as separate figures. Each figure is computed from likelihood as a percentage and impact in euros; the risk level is read from a configurable risk matrix.
Controls run as tasks with a planned reduction. While a task is planned, its reduction is reserved and lowers only the residual risk. On completion it is applied to the current risk, and cancelling the task releases the reservation. The gap between the current and the residual figure therefore shows which part of the reduction is still outstanding.