Which type of risk remains after risk treatment has been applied?

According to ISO 31000:2018, "residual risk" is the specific term for the risk that remains after risk treatment measures have been implemented. The risk management process involves identifying risks, analyzing them, and then applying treatments (controls) to modify them. However, it is rare for treatment to eliminate risk entirely. The level of risk that is left over after these controls are in effect is known as residual risk. This remaining risk must then be monitored, reviewed, and formally accepted by management.

A. Controlled risk: This is not a standard term defined in ISO 31000. While treatments are controls, "controlled risk" is not the formal name for the risk that remains.

C. Avoidance risk: Risk avoidance is a type of risk treatment option where an organization decides not to start or to exit an activity to prevent exposure to a risk. It is a strategy, not the remaining risk.

D. Accepted risk: Risk acceptance (or retention) is a decision to take on a particular risk. While residual risk is often the risk that is formally accepted, "accepted risk" refers to the decision itself, not the state of the risk after treatment.

1. International Organization for Standardization (ISO). (2018). ISO 31000:2018 Risk management — Guidelines. Geneva

Switzerland: ISO.

Section 3.9: Defines residual risk as the "risk remaining after risk treatment."

Section 6.5.2: Lists "avoiding the risk" and "retaining the risk" (acceptance) as options for risk treatment

distinguishing them from the concept of residual risk.

2. Purdy

G. (2010). ISO 31000:2009—Setting a New Standard for Risk Management. Risk Analysis: An International Journal

30(6)

881-886.

Page 884: The article explains the ISO 31000 process

noting that after risk treatment

"the resulting level of risk is called 'residual risk'." This confirms that residual risk is the outcome of the treatment step. DOI: https://doi.org/10.1111/j.1539-6924.2010.01442.x

3. Leitch

M. (2010). ISO 31000:2009—The New International Standard on Risk Management. Risk Management

12(4)

180-181.

Page 181: In describing the risk treatment phase of the ISO 31000 process

the author states

"The intention of risk treatment is to produce a residual risk that is as low as reasonably practicable

" clearly identifying residual risk as the post-treatment state. DOI: https://doi.org/10.1057/rm.2010.9