Skip to main content

Residual risk calculation

Residual risk is what remains of a risk after its mitigating controls are taken into account. The platform calculates it from three building blocks — the initial risk value, additional type and category values, and the combined rating of the related controls:

Inherent Risk = Initial Risk + Risk Type value + Risk Category values

Combined Controls = (average key control rating × key weight) + (average non-key control rating × non-key weight)

Residual Risk = Inherent Risk − Combined Controls

This page applies to risks with the Standard and Value data types, which differ only in where the initial risk value comes from. ICS risks track impact and likelihood differently — see ICS risks.

Overview​

The values that feed the calculation — the risk matrix, the extra values per risk type and category, the value behind each control rating, the key/non-key weights, and the color ranges — are all configured per repository by your repository administrator. The Legend in the Risk section of any risk's main page links to the current configuration, and the section's expandable table shows the exact numbers used for that object.

Initial risk value​

Where the initial value comes from depends on the risk's Data Type:

  • Standard — each data point on the risk's Data tab combines an Impact and a Likelihood, and the risk matrix maps that combination to a number. For example, High impact and Medium likelihood might map to 12.
  • Value — the data point holds the number directly. There's no matrix, and no impact, likelihood, or appetite to set.

From there the two behave identically: the same type and category values are added, the same controls are combined, and the residual is calculated the same way.

The calculation uses the current data point: the most recent one whose date isn't in the future.

Inherent risk value​

The risk's type and categories can each carry an additional risk value, configured by the repository administrator; by default these are zero, so in many repositories the inherent value equals the initial value. The inherent risk is the initial value plus the type value plus the value of every category assigned to the risk.

The color shown next to the value comes from the repository's Risk Ranges — the inherent value falls into a configured range, and the range's color is displayed.

Combined controls​

Every Control and Control Instance related to the risk through Controlled By contributes its Control Rating — each rating has a numeric value in the repository configuration. Ratings are averaged separately for key and non-key controls (the Control Keying setting), and each average is multiplied by a weight:

  • Only key controls related: the key average counts at 100%.
  • Only non-key controls: the non-key average counts at 75%.
  • A mix of both: key controls count at 75% and non-key controls at 25%.

These are the default weights; your repository administrator can change them in the control configuration. The sum of the weighted averages is the combined control value.

Residual risk value​

The residual risk is the inherent value minus the combined control value. It never goes below zero — fully mitigated risks show 0, not a negative number. Its color again comes from the risk ranges.

Worked example​

A risk's current data point is High impact × Medium likelihood, which the matrix maps to 12. Its type and categories add nothing, so the inherent risk is 12. One key control with a rating worth 8 is related through Controlled By — the only control, so its average of 8 counts at 100%, and the combined control value is 8.

Residual Risk = 12 − 8 = 4

The Risk section of a risk's main page showing the worked example: inherent risk 12, combined controls 8, residual risk 4, with the calculation breakdown table.

Category coverage warning​

A warning icon next to the residual value means the related controls don't cover all the risk's categories. Controls carry the same Risk Categories setting as risks; the platform expects the controls mitigating a risk to cover at least every category the risk is assigned to. Select View Categories to see which categories have mitigating controls and which don't. These warnings are on by default. An administrator can switch them off for the whole repository with Show Category Warnings On Risk Objects, on the Risk Categories tab of Risk and Risk Instance configuration.

Related tasks & references​