Residual risk

Residual risk = inherent risk adjusted for the effectiveness of controls in place. ISO 45001 requires organisations to determine whether residual risk is acceptable (tolerable) or requires further action. A risk register typically records both inherent and residual scores for each entry. Residual risk is the basis for management decisions on further treatment.