Residual risk vs Risk appetite

Why they differ

Residual risk is what is actually left; risk appetite is how much leadership is willing to leave. The first is measured against the second.

Residual risk

Risk management

The risk still left after controls are in place, because no protection removes danger completely.

Formal

The level of risk that remains once the chosen controls have been applied, which the risk owner must then either formally accept or treat further.

In plain English

Even with a seat belt, driving still carries some chance of getting hurt.

In practice

After a municipality adds MFA and awareness training, phishing drops from red to yellow on its heat map, and the municipal director signs off that the yellow level left over is acceptable.

Why it matters

Pretending controls make risk vanish hides the danger that remains; naming it forces a named person to accept it or pay to reduce it further.

Risk appetite

Risk management

How much risk leadership is willing to live with to reach the company's goals.

Formal

A leadership decision stating the amount and type of risk an organisation will accept, used as the line that decides whether a risk needs further treatment.

In plain English

Like how fast you are willing to drive - some people accept more danger to arrive sooner, others do not.

In practice

A pension fund's board writes down that it accepts no risk of losing members' data, but will live with short outages of the internal chat, and the IT security manager plans controls to match.

Why it matters

Without a stated limit, every risk decision becomes a matter of opinion, and leadership cannot be held to account.

Shared connections

Risk Risk acceptance