thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Foundational

Residual Risk

Risk that remains after controls and treatments have been applied.

Definition

Residual risk equals inherent risk minus the risk reduced by controls; it can never be zero. It must be compared to risk appetite and formally accepted by the risk owner. Some texts express it as total risk minus countermeasures, or threats x vulnerabilities x asset value x control gap.

Example

After deploying backups and EDR, the remaining ransomware risk is rated medium and accepted.

Exam tip

Residual risk must be within appetite and accepted; it is never eliminated.

Don't confuse it with

Related terms