Glossary · Foundations
Residual Risk
The risk that remains after controls have been applied to treat it, and that the risk owner has to accept, transfer or treat further.
Put the term into practice: Risk management software
Residual risk is what is left once treatment has reduced the original, inherent risk. No set of controls removes risk entirely, so some level always remains.
Management must formally accept the residual risk, confirming it falls within the organisation's risk appetite. In an ISMS this acceptance is a documented decision by risk owners.
