Residual Risk (Ryzyko rezydualne)

Inherent risk is the level of risk as it would exist without any controls in place. Once controls are implemented, what remains is residual risk, which is what the organisation actually lives with. Residual risk is compared against the risk appetite to decide whether it is acceptable or whether further action is needed.

The critical point is to calculate residual risk after controls have been applied, not before. Risk matrices in spreadsheets often display stale figures because someone implemented a control but never recalculated the effect. After a few months it is no longer clear which risk entries are current.

Accepting residual risk is also a decision, but it must be a conscious and documented one. “We did nothing because we forgot” is not acceptance; it is a gap that an audit will identify immediately.