Glossary
Residual risk
Residual risk is the level of risk that remains after the existing controls have been applied and their effectiveness taken into account.
Residual risk explained
Once the controls in place are considered, the risk that is left over is the residual risk. It is the score that matters day to day, because it reflects the institution's real exposure and is what gets compared with risk appetite.
Residual risk is only as reliable as the assessment of the controls. If a control is rated effective but is not actually operating, the residual score is understated. That is why control testing and self-assessment feed directly into it.
For example, an institution may accept a residual risk that sits within appetite, or decide that further treatment is needed because the residual score is still too high.
Why it matters in life insurance
Boards and regulators in Zambia read the residual heat map to judge whether an institution is within its stated appetite, so it must be refreshed when controls change or fail, not just once a year. ERMAML, the Ontech Risk & Compliance Suite, recalculates residual scores as control assessments and incidents are recorded and tracks treatment cost in kwacha.
Related terms
Inherent risk · Risk appetite · RCSA (risk and control self-assessment)