Residual Risk
Residual Risk is the level of risk that remains after controls and mitigations have been applied.
Why it matters
Residual risk is what the buyer ultimately accepts, tracks, or requires further remediation on before approving a vendor.
Where it appears in the workflow
Determined after assessment to decide whether to approve, remediate, or grant an exception.
Common mistakes
- Treating residual risk as a universal term with no workflow context.