Residual risk

Residual risk is the risk that remains after taking all possible or any economically reasonable steps to avoid it.

Characteristic

Residual risk is the risk remaining after the risk control procedures have been selected for specific hazards. They can only be considered true if selected procedures for its elimination or reduction have been implemented. Whenever specific procedures for identified threats are selected, these threats are re-estimated and the risk level is verified again. It should be taken into account that the application of selected procedures will not be sufficient to significantly reduce the level of risk. The total residual risk should be determined by considering individual residual risks relating to each identified hazard.

Depending on the likelihood and severity of a potentially threatening event and real current hazards, the residual risk for each hazard may be different. It is commonly assumed that the total residual risk is to be equal or greater to the highest identified risk that concerns one of the identified risks. In addition, both the quantity and the nature of existing threats should be taken into account.

In some cases, the project manager may decide that the total residual risk is higher than any of the hazards. The basis for making such a decision is the number of threats with lower risk if they present a threat of a larger scale in the statement. For example, the result of a risk assessment in a specific undertaking may be a moderate residual risk for individual identified threats. However, taking into account the complexity of the requirements of procedures controlling the risk and the synergistic effect of all hazards, the project manager will decide that the residual risk for the entire undertaking is too high to take them.

Types of residual risk

Residual risk, which is deliberately not subject to any restrictions because it has been accepted, is also referred to as acceptable risk. Its specific manifestation is residual risk, i.e. the risk that remains after the implementation of collateral. In practice, such a risk is always out of necessity, since no system is completely safe, and some resources are intentionally not protected. It is important, however, that the persons deciding on the choice of security should be aware of the residual risk and fully accept it. Faced with such a case, only an alternative becomes possible for them: they accept the risk, or decide to apply additional safeguards, aimed at mitigating the risk, i.e. reducing it to an acceptable level, which is usually closely related to incurring additional costs. It is therefore good to take action towards risk control.

Residual risk management

Comprehensive risk management Composite Risk Management is a method used to identify hazards and control risks associated with them. It consists of five basic activities:

1. Hazard identification,
2. Threat assessment,
3. Development of risk control tools,
4. Implementation,
5. Supervision

The first two stages are stages of risk assessment, the last two are elements of risk management. It is only in the third stage that risk control procedures are developed and implemented, with the aim of eliminating threats or minimizing the risks associated with them. Then the risks are verified to determine the residual (remaining) risk until the acceptable level of risk is achieved or any risk is not reduced to a level where benefits outweigh the costs incurred. This stage should be carried out when developing, considering and compiling various operational options and selecting one of them, that is making a decision.

The goal of the entire risk assessment and management process is to create the basis for making the optimal decision regarding risk acceptance or lack thereof. The key element is to define an acceptable level of risk. the risk or possibility of potential losses must be balanced with the expected benefits. The decision as to accepting the risk limit should be made at the level of management adequate for the given operation or task, and the basis for undertaking it is the level of the existing risk.

Making risky decisions is not always associated with negative effects; it often accompanies entrepreneurship and innovation, which is one of the drivers of the development of capitalism. Negative consequences usually arise when a certain threshold of tolerable risk is exceeded, beyond which only the area of ​​unacceptable bravado and lack of control extends. This is why they are extremely necessary, scenarios of anti-risk activities.

Examples of Residual risk

• Cybersecurity: Despite taking steps such as implementing firewalls, antivirus software and other measures, there is still a risk of a data breach due to malicious actors.
• Natural Disasters: Despite taking steps such as building buildings to withstand earthquakes and other extreme weather, there is still the risk of property damage and even loss of life due to natural disasters.
• Business Risk: Despite taking steps to diversify and hedge against certain risks, there is still the risk of financial losses due to changing market conditions.
• Human Error: Despite taking steps to train employees and instill best practices, there is still the risk of errors due to human oversight or negligence.

Advantages of Residual risk

Residual risk is the risk that remains even after all possible or economically reasonable steps have been taken to avoid it. The advantages of residual risk include:

• Increased understanding of risk: By understanding what residual risk remains, organizations are better able to anticipate and prepare for potential issues.
• Improved decision-making: Knowing which risks remain and their associated costs allows organizations to make more informed decisions about how to allocate resources.
• Cost reduction: By understanding the residual risks and their associated costs, organizations are better able to reduce costs by making more efficient use of resources.
• Improved communication: Knowing which risks remain allows organizations to better communicate with stakeholders and build trust.
• Better risk management: By understanding residual risk, organizations are better able to develop strategies to reduce or mitigate it.

Limitations of Residual risk

Residual risk is the risk that persists after all feasible or cost-effective measures have been implemented to mitigate it. Despite its utility, there are certain limitations associated with residual risk. These include:

• The difficulty in accurately estimating the residual risk, as there are often unknown risks which cannot be quantified or predicted.
• The risk can be hard to control, as it is often unpredictable or difficult to manage.
• Residual risk can be costly to manage, as additional resources may be required to reduce it.
• Residual risk is often difficult to transfer, meaning organizations may be stuck with the risk.
• Residual risk can be difficult to monitor and measure, as it is often difficult to detect or measure.
• Residual risk can be hard to explain or communicate, as it can be difficult to explain the reasons behind the risk.

Overall, residual risk can be a difficult concept to manage, and organizations must be aware of the limitations when dealing with it.

Other approaches related to Residual risk

There are many methods and techniques that can be used in order to reduce and manage residual risks. These include:

• Risk Acceptance: This involves a conscious decision to accept the risk, rather than taking action to eliminate it.
• Risk Avoidance: This involves taking steps to avoid the risk altogether, by either refraining from engaging in the activity that is creating the risk, or by finding an alternate way of performing the activity.
• Risk Transfer: This involves transferring the risk to another party, such as an insurance company.
• Risk Mitigation: This involves taking steps to reduce the potential impact of the risk, such as implementing safety protocols or instituting controls that reduce the likelihood of the risk occurring.
• Risk Management: This involves actively monitoring the risk and taking steps to ensure that it remains within acceptable limits.

In summary, there are many approaches to managing residual risk, including risk acceptance, risk avoidance, risk transfer, risk mitigation, and risk management. Each approach has its own advantages and disadvantages, and must be considered carefully in order to determine which approach is most appropriate for a particular situation.

Residual risk — recommended articles

Risk response — Risk evaluation — Cost risk — Risk management strategy — Retention of risk — Implementation of information security management system — Technical risk — Business risk management — Accident management

References

• McNeil, A. J., Frey, R., & Embrechts, P. (2005). Quantitative risk management: Concepts, techniques and tools (Vol. 3). Princeton: Princeton university press.
• Embrechts, P., McNeil, A., & Straumann, D. (2002). Correlation and dependence in risk management: properties and pitfalls. Risk management: value at risk and beyond, 1, 176-223.
• Jüttner, U., Peck, H., & Christopher, M. (2003). Supply chain risk management: outlining an agenda for future research. International Journal of Logistics: Research and Applications, 6(4), 197-210.