Residual Risk is the risk that remains after risk responses have been implemented.
It represents exposure that cannot be entirely eliminated and must be accepted, monitored, or further mitigated depending on its potential impact and probability.
Key Characteristics
- Post-Response Exposure – Exists even after mitigation, transfer, or avoidance actions
- Requires Monitoring – Tracked throughout the project to ensure it remains within tolerance
- May Be Accepted – If impact is minor or mitigation is cost-prohibitive
- Can Accumulate – Multiple small residual risks may compound to create greater exposure
Example Scenarios
- Accepting minor performance delays after risk mitigation reduces a critical path threat
- Continuing cost fluctuation risk after applying hedging strategies
- Monitoring residual technical risk after implementing partial design changes
Role in Risk Management
- Completes the Risk Picture – Captures what remains after planned responses
- Informs Contingency Planning – May require additional reserves or fallback strategies
- Supports Risk Acceptance Decisions – Helps justify tolerance-based decisions
- Feeds Into Continuous Risk Review – Ensures ongoing assessment as conditions evolve
See also: Secondary Risk, Risk Register, Contingency Reserve, Monitor Risks, Risk Response Plan.