Residual Risk.

The risk that remains after planned controls and treatments have been applied, which the organization must either accept, transfer, or treat further. It belongs to the Compliance & Frameworks category of cybersecurity.

The risk that remains after planned controls and treatments have been applied, which the organization must either accept, transfer, or treat further.

Residual risk is what is left of the inherent risk once existing or planned controls reduce likelihood or impact. It is the figure that matters most for decision-making because controls are never perfect and threats evolve. Organizations compare residual risk to their risk appetite and tolerance: anything above must be treated further, escalated, or formally accepted with documented justification and an owner. Residual risk is recorded in the risk register and reviewed periodically, especially when controls fail, threats change, or new dependencies emerge. Boards and regulators increasingly demand explicit residual risk reporting to demonstrate informed decisions.

Defences for Residual Risk typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Net risk, Post-control risk.