Residual risk is the actual risk remaining after your internal controls are applied. It is the final metric executives use to determine if operations align with the firm’s risk tolerance.
The Residual Risk Calculation
While some traditional frameworks use simple subtraction, an enterprise compliance risk model treats internal controls as a percentage-based mitigation factor. The safe plain-text formula is written as follows:
Residual Risk Score = Inherent Risk Score * (1 - Control Effectiveness Percentage)

Where:
  • Inherent Risk Score = The raw baseline risk level (scaled from 1 to 5)
  • Control Effectiveness Percentage = The validated strength of the controls (expressed as a decimal from 0.0 to 1.0)

For example, if a specific operational business unit has an Inherent Risk Score of 4.5 (Critical) and its tested controls show an Effectiveness rating of 80% (0.80), the unchangeable text calculation is:
Residual Risk Score = 4.5 * (1 - 0.80) = 4.5 * 0.20 = 0.90 (Low Risk Zone)

The 5 x 5 Strategic Risk Heat Map Matrix
Organizations map their residual risk scores onto a standardized matrix to visually highlight exposures that require immediate leadership attention.

Likelihood Rating Impact: 1 (Negligible) Impact: 2 (Minor) Impact: 3 (Moderate) Impact: 4 (Major) Impact: 5 (Catastrophic)
5 (Almost Certain) Medium High High Critical Critical
4 (Likely) Medium Medium High High Critical
3 (Possible) Low Medium Medium High High
2 (Unlikely) Low Low Medium Medium High
1 (Rare) Low Low Low Medium Medium

Risk Response Framework
  • Critical Matrix Zones: Requires immediate suspension of the activity until stronger controls are implemented.
  • High Matrix Zones: Requires executive intervention and monthly monitoring reports to the risk committee.
  • Medium Matrix Zones: Managed through standard operational reviews and routine control maintenance.
  • Low Matrix Zones: Accepted under standard operating procedures with annual control validations.

 
PreviousNext