# Residual risk

The risk that remains after treatment, compared with your acceptance criteria and formally accepted by a named risk owner.

Source: https://sted.digital/docs/glossary/residual-risk · Last reviewed 17 October 2026 · Strand Glossary

Residual risk is the risk that remains after you have treated it. You compare it with your risk acceptance criteria, and a named risk owner accepts it. If it is still above what you will accept, you treat it again or record why the organisation is choosing to carry it.

## Where the term appears

ISO 27001:2022 6.1.3 f) asks risk owners to approve the treatment plan and accept the residual information security risks. ISO 42001:2023 6.1.3 carries the same step for AI risks. For medical devices, ISO 13485:2016 7.1 brings in risk management for product realisation, and ISO 14971, the standard used to meet it, asks you to evaluate each residual risk and then the overall residual risk of the device against the benefits of its intended use. The [risk assessment and treatment page](/docs/standards/iso-27001/risk-assessment-and-treatment) covers acceptance in clause 6.1.

### Inherent and residual

Inherent risk is the score before any treatment; residual risk is the score after it. Some registers add a middle column for current controls. An auditor checks that a lower residual score rests on controls that are actually in place, that acceptance is dated and signed by the risk owner, and that no risk above the criteria has been accepted without a recorded reason.

## How Sted uses it

The Risks and opportunities register holds each risk's likelihood and impact before and after controls, the controls in place, whether it is above your risk appetite, its treatment plan, an owner and a last-reviewed date, and lists its inherent and residual levels.
Risk levels are computed from likelihood and impact.
For ISO 27001 risk work Sted's knowledge base carries the Risk Management Procedure (PRC-RMP) with its Operating Risk Assessment Record (REC-ORAR) and Operating Opportunity Assessment Record (REC-OORA), and for planned changes the Change Management Policy (POL-CHG) with its Change Record (REC-CR).
Records are part of the Full Management System plan.

## Related terms

- [Risk register](/docs/glossary/risk-register): where inherent and residual scores sit side by side.
- [Risk treatment plan](/docs/glossary/risk-treatment-plan): the actions that reduce a risk to its residual level.
- [Control](/docs/glossary/control): what a residual score relies on.
- [Statement of Applicability](/docs/glossary/statement-of-applicability): records whether those controls are implemented.
- [How to run a risk assessment](/docs/guides/risk-assessment): scoring and accepting risk, step by step.