Residual risk
Residual risk is the exposure remaining after considering the risk responses and controls actually in place. It is compared with appetite or other relevant criteria to decide whether further action is needed. An assessment should distinguish current exposure from a target level that assumes additional planned measures will work. Residual risk can change when controls weaken or circumstances develop.
Worked example
A supplier interruption would severely affect production. A backup supplier reduces the assessed exposure, but its limited capacity leaves some potential disruption. That remaining exposure is residual risk; a proposed additional source belongs in the future target assessment until established.
Common mistake
Do not confuse residual risk with agency residual loss, or count an unimplemented plan as an effective existing control.
Where it appears in your exams
| Qualification | Exam | Relationship | Period |
|---|---|---|---|
| ACCA | SBL | Supporting | September 2026–June 2027 |