Residual risk: the risk that remains after controls
Residual risk is the risk that remains after controls are applied. It is what management formally accepts, and it is the number an auditor compares to the organisation's risk appetite. Every framework that requires a risk register — ISO 27001, ISO 42001, SOC 2, CMMC — expects you to distinguish inherent risk from residual risk.
How residual risk is calculated
Start with inherent risk: the likelihood and impact of a threat before any control is in place. Then assess how much the controls reduce it. What remains is the residual risk. Some organisations score this on a matrix (likelihood × impact); others use quantitative methods like Monte Carlo simulation.
The residual risk for each entry in the risk register should be below the risk appetite set by leadership. If it is not, the risk needs further treatment or formal acceptance at a higher level.
What auditors look for
Auditors check that each risk has both an inherent and a residual score, that the controls listed actually reduce the risk (not just listed for show), that someone named owns the residual risk, and that risks above appetite have been escalated and formally accepted.
- Inherent and residual scores on every risk
- Controls linked to the risks they treat
- Named risk owner for each residual risk
- Formal acceptance where residual risk exceeds appetite
- Re-assessment at planned intervals or after changes
Tracking residual risk in Certifyi
In Certifyi, each risk in the register carries an inherent score, the controls that treat it, and a residual score. The heatmap shows residual risk by default, and risks above appetite are flagged for review.
- Risk management software: register, heatmaps and control linkage.
- Risk register: where residual risk lives.
- Risk appetite: the threshold residual risk is compared to.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them