Residual Risk: Definition and How Auditors Treat It
Residual risk is the risk that remains after you've put controls in place. It is inherent risk minus the effect of mitigations. ISO 27001, SOC 2, NIST CSF and every other control framework assumes that no mitigation eliminates risk completely — the question is whether what's left is acceptable.
Residual vs Inherent vs Accepted
- Inherent risk: the risk level before controls — the raw exposure.
- Residual risk: the risk level after controls — what you actually carry on the business.
- Accepted risk: residual risk that an identified owner has signed off as tolerable.
The three are often confused. Auditors look for all three to be distinct in your risk register, each with a stated value and a named owner.
How Residual Risk Is Measured
Most control frameworks are agnostic about the method, but auditors expect consistency across your register:
- Qualitative — Low / Medium / High on both likelihood and impact.
- Semi-quantitative — a 1–5 scale on each dimension, product gives a 1–25 score.
- Quantitative — expected annual loss in currency terms. Rare outside financial services.
Pick one, apply it everywhere. Switching methods mid-register is an audit finding.
What Auditors Check
- Each identified risk has a residual rating.
- Each residual rating has a documented justification — which specific controls reduce inherent to residual, and by how much.
- Residual ratings above your risk appetite are either further mitigated or formally accepted by the risk owner (not the risk register maintainer).
- Residual ratings are revisited at least annually and after material changes.
Common Pitfalls
- Residual = inherent on every row. Means no credit is being taken for controls. Looks lazy.
- Residual far below inherent without justification. Means you're overclaiming control effectiveness. Auditors will probe.
- No owner on accepted residual risks. The CISO's name on every row isn't accountability.
- Static residual ratings. Risk register unchanged for 12 months in a growing company isn't believable.