Residual risk

Residual risk is the risk that remains after controls and treatments are in place. It is the exposure you are actually carrying, and the number risk committees care about most.

You calculate it by discounting the inherent score — likelihood × impact — by how much the controls in place actually reduce the exposure. If residual risk still sits above your risk appetite, further risk response is needed.

How Rukn ERM calculates it

Rukn ERM applies one formula across every risk in the register, so two risks with the same inputs always carry the same residual score:

inherent = likelihood × impact
residual = round( inherent × (1 − effectiveness × 15%) )

Likelihood and impact are each rated 1–5, so an inherent score runs from 1 to 25. Control effectiveness is rated 1–5 as well, and every point removes 15% of the inherent score:

• 1 — Ineffective: −15%
• 2 — Marginal: −30%
• 3 — Partially effective: −45%
• 4 — Largely effective: −60%
• 5 — Fully effective: −75%

The reduction stops at 75% deliberately. No set of controls takes a risk to zero, and a residual score of zero would claim exactly that — so even a very strong control environment leaves a quarter of the inherent exposure on the register.

Where a risk has controls mapped to it, effectiveness is derived from the rounded average of those control ratings rather than typed in, so improving a control updates every risk it protects. A risk with no rated controls keeps whatever effectiveness the risk owner set by hand; leaving it unrated makes residual equal inherent — an unassessed control environment earns no reduction.

Both scores are banded the same way: 1–4 low, 5–9 medium, 10–16 high, 17–25 critical. Appetite breaches and heat maps read the residual band.

Related terms

Going deeper: Inherent vs residual risk, with worked examples shows the scoring arithmetic in full.