Residual risk is the level of risk remaining after existing controls and the measures taken have been applied. The level before measures is called inherent risk.
The aim of risk management is not to reduce risk to zero; it is to bring residual risk within the defined risk appetite. For residual risk that remains above the appetite, either additional measures are taken or the conscious acceptance of the risk is recorded with an authorized approval.
Evaluating residual risk depends on verifying that the controls are actually effective. A control that is assumed to exist but whose effectiveness has not been tested makes residual risk look lower than it is.
Related terms: Risk Appetite · Risk-Based Thinking
Related training: Risk-Based Thinking and Risk Management