Project Management guide · Risk, quality and control
Residual Risk in Project Management: Meaning and Examples
Residual risk in project management is the risk that remains after you have planned and carried out your risk responses. Few responses remove a risk completely, so most projects carry residual risk that must be measured, accepted by the right person, covered by reserves and monitored. This guide explains how to calculate it, with worked examples, and how to decide whether it is acceptable.
Key takeaways
- Residual risk is what is left after responses; inherent risk is the level before any response.
- A secondary risk is a new risk created by a response, which is different from residual risk.
- Calculate residual risk by re-scoring probability and impact, or expected monetary value, after responses.
- Compare residual risk with agreed tolerances; if it is too high, add responses or escalate.
- Significant residual risk should be accepted explicitly by the sponsor or board and recorded in the risk register.
What is residual risk?
Residual risk is the level of risk that remains after risk responses have been implemented. PMI's PMBOK Guide describes residual risks as those expected to remain after planned responses have been taken, including risks that have been deliberately accepted. ISO's risk management vocabulary (ISO Guide 73) defines it more briefly as risk remaining after risk treatment.
In plain terms, you start with a project risk, decide what to do about it, do it, and then ask: how likely is this now, and how bad would it be? The answer is the residual risk.
- It is an identified risk. You know about it, so you can plan for it, unlike unknown risks.
- It is rarely zero. Mitigation reduces probability or impact; transfer moves the financial effect; neither usually removes the event entirely.
- It is a decision point. Once you know the residual level, someone must decide whether it is acceptable.
- It is used beyond projects. Information security, health and safety, internal audit and enterprise risk management all use the same idea.
Inherent, residual and secondary risk
Four related terms come up in risk management and in PMP and CAPM exam questions. The table shows how they differ, using one data migration risk.
| Term | Meaning | Example |
|---|---|---|
| Inherent risk | The risk before any response or control | Data loss during migration: probability 3 x impact 5 = 15 |
| Residual risk | The risk that remains after responses | After full backups and a rehearsal: probability 1 x impact 4 = 4 |
| Secondary risk | A new risk created directly by carrying out a response | The rehearsal ties up the test environment, delaying other testing |
| Emergent risk | A risk that only becomes visible as the project progresses | A new data regulation is announced during delivery |
Residual risk vs secondary risk
The two are easy to confuse because both appear after a response. The difference is where they come from:
- Residual risk is the same risk, reduced but not removed. The event can still happen.
- Secondary risk is a different risk that your response has introduced. It needs its own entry in the risk register, its own score and owner.
Example: to reduce the risk of a skills shortage, you outsource testing to a specialist firm. Some chance remains that testing still runs late (residual risk). Outsourcing also creates a new chance that the firm misunderstands your requirements (secondary risk).
Why residual risk matters
Planning a response can create false comfort. Measuring residual risk keeps the risk picture honest.
- Honest reporting. Sponsors need to know what risk is left after the team's actions, not just what was originally identified.
- Right-sized reserves. Contingency reserve is usually sized from the expected cost of residual and accepted risks.
- Value for money. Comparing inherent and residual risk shows whether a response is worth what it costs.
- Clear accountability. When residual risk is recorded and formally accepted, everyone knows who decided to live with it.
- Better focus. Risks with high residual scores stay on the agenda; risks reduced to a low level can move to routine monitoring.
How each response strategy affects residual risk
The response you choose shapes what is left. These are the threat strategies PMI describes, with their usual effect on residual risk.
| Strategy | What it does | Typical residual risk |
|---|---|---|
| Avoid | Change the plan so the threat cannot occur, e.g. drop a risky feature | Close to zero for that risk, but check for new risks from the change |
| Mitigate | Reduce probability, impact or both | Lower than inherent; the most common source of residual risk |
| Transfer | Pass the financial impact to a third party, e.g. insurance or a fixed-price contract | Financial impact falls, but schedule and reputation impact may remain, and the third party may fail |
| Accept | Take no action now; perhaps hold a reserve or contingency plan | Equal to inherent risk |
| Escalate | Pass ownership to a higher level because it is outside the project's authority | Leaves the project register, but the organisation still carries it |
For opportunities the logic is reversed: after exploiting, enhancing or sharing, you re-assess how likely the benefit now is and how large it would be.
How to calculate residual risk
There is no single official formula. Most projects use one of the three methods below. Choose one, use it consistently and define your scales in the risk management plan.
Method 1: re-score probability and impact
This is the simplest and most common approach, and it matches the probability x impact matrix most registers use.
- Score the inherent risk: probability (1-5) x impact (1-5).
- List the responses and confirm they are realistic, funded and owned.
- Re-score probability and impact assuming the responses work as planned.
- Multiply to get the residual score.
For example, an inherent probability of 4 and impact of 4 gives 16. If mitigation reduces probability to 2 and impact stays at 4, the residual score is 8.
Method 2: expected monetary value
Where you can estimate costs, express residual risk in money. Residual expected monetary value = residual probability x residual cost impact. A 10% chance of a £20,000 overrun gives a residual exposure of £2,000. This is useful for sizing contingency reserve and for comparing responses with their cost. For a whole project, Monte Carlo simulation can combine many residual risks into a range of outcomes.
Method 3: control effectiveness
Some organisations, especially in security and audit, estimate how effective the controls are and reduce the inherent score accordingly: residual risk = inherent risk x (1 - control effectiveness). An inherent score of 15 with controls judged 60% effective gives 6. Treat this as a rough guide: effectiveness percentages are judgements, and a response that cuts probability does not always cut impact.
Worked example: residual risk on a construction project
A construction project depends on a hired tower crane to erect the steel frame. A breakdown could stop work for up to six weeks while a replacement is found.
| Step | Detail | Score or value |
|---|---|---|
| Inherent risk | Probability 3 (possible) x impact 5 (very high) | 15 (high) |
| Inherent exposure | 30% chance x £120,000 cost of a six-week delay | £36,000 |
| Response 1 | Weekly inspections by the hire company reduce probability | Probability 2 |
| Response 2 | Standby agreement with a second hire company limits any delay to three days | Impact 2 |
| Residual risk | Probability 2 x impact 2 | 4 (low) |
| Residual exposure | 10% chance x £15,000 cost of a three-day delay | £1,500 |
| Cost of responses | Inspection fees plus standby fee | £5,000 |
| Secondary risk | The standby company may not have a crane free at short notice | Logged separately, score 3 |
The responses cost £5,000 and reduce expected exposure by £34,500, so they are clearly worthwhile. The residual score of 4 is within the project's tolerance of 6, so the project manager records the risk as accepted at its residual level, holds £1,500 in contingency reserve and keeps monitoring the inspection reports.
The figures here are illustrative. On your own project, use your organisation's scales and cost estimates.
More residual risk examples
| Project | Inherent risk | Response | What remains (residual risk) |
|---|---|---|---|
| IT system migration | Data may be corrupted during cut-over (3 x 5 = 15) | Full-volume rehearsal and verified backups | A small chance of corruption that a rollback could fix within a day (1 x 3 = 3) |
| Outdoor event | Bad weather may reduce attendance (3 x 4 = 12) | Marquee hire and cancellation insurance | Attendance may still fall; reputation impact is not insured (3 x 2 = 6) |
| Software release | A security flaw may be released (2 x 5 = 10) | Code review, automated scanning and a penetration test | Unknown flaws may remain (1 x 5 = 5), so monitoring and an incident plan stay in place |
| Supplier contract | Supplier may deliver late (4 x 3 = 12) | Penalty clause and weekly progress checks | Late delivery is less likely, but penalties do not recover lost time (2 x 3 = 6) |
| Marketing launch | A competitor may launch first (2 x 4 = 8) | Accept and prepare a differentiated message | Unchanged, as the risk was accepted (2 x 4 = 8) |
Notice that transfer and penalty clauses often reduce the financial effect but not the schedule or reputational effect. Record what remains honestly.
How to assess residual risk step by step
- Score the inherent risk using the agreed probability and impact scales.
- Agree the responses, with an owner, cost and date for each action.
- Estimate the planned residual risk: re-score assuming the responses work. This is your target.
- Check for secondary risks created by the responses and log them separately.
- Compare with tolerances set in the project management plan.
- Decide: accept, add further responses or escalate.
- Record the decision, including who accepted the residual risk and when.
- Re-score once the responses are complete to get the actual residual risk, and keep monitoring triggers.
Is the residual risk acceptable?
Deciding whether residual risk is acceptable is a judgement, but it should follow agreed rules rather than gut feel.
- Compare it with tolerances. Your risk management plan should say which scores the project can accept and which need escalation, based on the organisation's risk appetite.
- Weigh the cost of further reduction. If another response would cost more than the exposure it removes, accepting the residual risk is often sensible. A cost-benefit analysis helps here.
- Consider non-financial effects. Safety, legal and reputational risks may need to be reduced further even when the money case is weak.
- Make the decision visible. Significant residual risks should be accepted explicitly by the sponsor or project board through the project's governance arrangements, not quietly by the team.
An example of agreed rules, using the 1-25 scoring scale:
| Residual score | Band | Typical action |
|---|---|---|
| 15-25 | High | Not acceptable at project level; add responses or escalate to the sponsor or board |
| 8-14 | Medium | Acceptable only with sponsor agreement, a contingency plan and close monitoring |
| 1-7 | Low | Project manager can accept; monitor at normal review frequency |
These bands are our suggestion, not a standard. Set your own to reflect your organisation's appetite and the project's importance.
Managing residual risk: contingency reserve and fallback plans
Accepted residual risk still needs a plan. Two tools are commonly used.
| Tool | What it is | When it is used |
|---|---|---|
| Contingency plan | Actions to take if the risk occurs | Triggered when the risk event happens or a trigger is reached |
| Fallback plan | A second set of actions if the contingency plan does not work | For high-impact risks where a single plan is not enough |
| Contingency reserve | Time or money set aside for identified risks, including residual ones | Sized from expected values and drawn down if risks occur |
| Management reserve | Time or money for unknown risks, held outside the baseline | Released through governance for risks nobody identified |
Contingency reserve sits inside the cost baseline and is part of the project budget. Summing the residual expected values of your accepted risks gives a defensible starting point for its size.
If a residual risk does occur, it becomes an issue: move it to the issue log, carry out the contingency plan and, if the budget or schedule changes, go through change control.
Recording residual risk in the risk register
A register that only shows one score hides the effect of your responses. Add columns so the before and after picture is clear.
| Column | What to record |
|---|---|
| Inherent probability, impact and score | The assessment before any response |
| Response strategy and actions | Avoid, mitigate, transfer, accept or escalate, with dates and owners |
| Planned residual score | The expected score once responses are complete |
| Actual residual score | The re-assessed score after responses have been carried out |
| Residual exposure (optional) | Residual probability x cost impact, used for reserves |
| Accepted by and date | Who accepted the residual risk and when |
| Secondary risks | References to any new risks created by the response |
Our free risk register template calculates a probability x impact score automatically; add residual score and acceptance columns beside it to track the after-response position.
Reporting residual risk to sponsors
Sponsors and boards do not need every risk, but they do need to know what risk the project is carrying.
- Show the top risks with inherent and residual scores side by side, so the effect of responses is visible.
- Highlight any residual risks above tolerance and the decision you need from the sponsor.
- Report the remaining contingency reserve against the residual exposure it is meant to cover.
- Include residual risk in the regular project status report and in stage-gate reviews.
On smaller projects a RAID log can hold risks, assumptions, issues and dependencies in one place; see our RAID log template.
Common mistakes with residual risk
- Assuming a response removes the risk. Unless you have avoided it, something usually remains.
- Re-scoring too early. Reducing the score when the response is planned, rather than done, overstates progress.
- Ignoring secondary risks. Every response can create new risks; check for them each time.
- Treating transfer as elimination. Insurance or contracts move money, not time, reputation or safety.
- Keeping it from the sponsor. Residual risk accepted silently by the team is not properly accepted.
- No reserve. Accepting residual risk without contingency time or money means any occurrence becomes a budget or schedule problem.
- Never revisiting it. Conditions change; review residual scores at every risk review and stage gate.
Residual risk is one part of a wider process of identifying, analysing, responding to and monitoring risks.
Free templates for this topic
Frequently asked questions
What is residual risk in project management?
The risk that remains after risk responses have been planned and carried out. It is the same risk as before, at a reduced (or, if accepted, unchanged) level of probability or impact.
What is an example of residual risk?
A team runs a full rehearsal and takes backups before a data migration. Data corruption is now much less likely, but a small chance remains. That remaining chance and its effect are the residual risk.
How do you calculate residual risk?
Re-score probability and impact assuming the responses are in place and multiply them, or calculate expected monetary value using the reduced probability and cost impact. Some organisations instead reduce the inherent score by an estimated control effectiveness.
What is the formula for residual risk?
A common shorthand is residual risk = inherent risk - the effect of responses or controls. In practice you calculate it as residual probability x residual impact, or as inherent risk x (1 - control effectiveness).
What is the difference between inherent risk and residual risk?
Inherent risk is the level of risk before any response or control; residual risk is the level that remains after responses.
What is the difference between residual risk and secondary risk?
Residual risk is what remains of the original risk after a response. A secondary risk is a new, different risk that arises directly from carrying out a response.
Can residual risk be zero?
Rarely. Only avoiding a risk completely, for example by removing the activity that causes it, brings that risk close to zero, and even then the change may introduce new risks.
Who accepts residual risk on a project?
The project manager can usually accept low residual risks. Significant ones should be accepted by the sponsor or project board, in line with the project's governance and tolerances.
What is an acceptable level of residual risk?
One that falls within the tolerances agreed in the risk management plan and reflects the organisation's risk appetite. What is acceptable varies by organisation and by the type of impact, especially for safety and legal risks.
Where is residual risk recorded?
In the risk register, usually in a residual score column next to the inherent score, with the name of the person who accepted it and the date.
What do you do if residual risk is too high?
Add further responses, change the plan to avoid the risk, transfer more of the impact, escalate it to a higher level or, in extreme cases, decide not to proceed.
How is residual risk covered financially?
Usually through contingency reserve, which is sized from the expected cost of identified risks including residual and accepted ones. Management reserve covers unknown risks.
What is a fallback plan?
A second set of actions to use if the contingency plan for a risk does not work. Fallback plans are often prepared for residual risks with a high impact.
Is residual risk used outside project management?
Yes. It is a standard concept in information security, internal audit, health and safety and enterprise risk management, where it is often defined as the risk remaining after risk treatment.