Residual risk

The exposure remaining once the planned response has been applied, scored on the same scale as the inherent assessment so the two can be subtracted.

Residual risk is what is left after the response, and it only means anything next to the inherent score it was derived from. The gap between the two is the measurable value of the response, which is the figure a sponsor is really being asked to fund. A residual score equal to its inherent score says the response has bought nothing yet, and that is a signal rather than a rounding error. A residual score higher than its inherent score is possible and worth recording, because a response can introduce exposure of its own.

See also

Where this comes up