Residual risk
- Term
- Residual risk
- Exam
- CISA & CISM
- Definition
The risk remaining after risk treatment.
- Explained
Residual risk is what remains after treatment. Management compares it with risk appetite: if it is within appetite it can be formally accepted; if not, further treatment or escalation is needed. Residual risk estimates should rely on tested control effectiveness rather than assumed effectiveness.
- In practice
After adding MFA, the remaining risk of account takeover is the residual risk the owner must accept or treat further.
- Often confused with
- Inherent risk
- Exam angle
It is compared with risk appetite to decide whether more action is needed.
- Related