Residual risk
Also called net risk, remaining risk
Residual risk is the risk that remains after a firm's controls and mitigating measures have been applied to an inherent risk. It is the exposure the firm actually carries, and it is the figure senior management compares with risk appetite to decide whether to accept the risk, strengthen controls or stop the activity.
How it works
Firms reach residual risk by starting from the inherent risk rating and assessing the design and operating effectiveness of the controls that address it. Control strength is usually rated on a scale such as strong, adequate or weak, and a matrix combines it with the inherent score. A high inherent risk with strong controls might come out as medium residual risk; the same risk with weak controls stays high.
The residual rating drives the response. Residual risk inside appetite is accepted and monitored through key risk indicators and control testing. Residual risk above appetite needs an action plan with an owner and deadline, extra controls, insurance or transfer, or a decision to exit the activity. Senior management or the board formally accepts any residual risk outside appetite, and reporting tracks it until it is brought back within limits.
The rules
Expects banks to set thresholds or limits for inherent and residual risk, assess risk after controls in self-assessments and report residual operational risks not mitigated by controls.
Banks under Basel Committee standardsDefines residual risk as the level of risk that remains after AML/CFT systems and controls are applied to the inherent risk, and uses it to set supervisory intensity.
EU AML/CFT supervisors, in how they assess obliged entitiesCommon questions
How do you calculate residual risk?
Most firms use a matrix: the inherent risk rating on one axis and control effectiveness on the other. Some use a formula such as inherent score minus a control credit. Either way the method must be documented and applied consistently.
Can residual risk be zero?
No. Controls reduce risk but never remove it entirely. The aim is to bring residual risk within the firm's risk appetite, not to eliminate it.
Who accepts residual risk?
The risk owner in the first line proposes acceptance, and senior management or the board signs off residual risk that sits outside appetite, with a plan to bring it back within limits.
