Residual risk is the level of risk that remains after controls have been put in place to reduce a hazard. Almost no control removes risk completely, so once guards, procedures, training and PPE are in place, some chance of harm is left over. That remaining risk must be judged acceptable, reduced further or formally accepted by someone with the authority to do so.
Residual risk matters because it is the risk workers actually face on the job. A risk assessment that rates only the hazard before controls, or assumes controls will always work, can give a false sense of security. Rating residual risk shows whether the controls are good enough and where more work is needed.
What Is Residual Risk?
In a typical risk assessment, each hazard is rated twice:
- Inherent (initial) risk: the risk before any controls, or with only existing controls, depending on the method your organization uses.
- Residual risk: the risk after the planned or existing controls are applied and working as intended.
For example, a press brake without guarding might be rated as a high inherent risk for amputation. After installing light curtains, two-hand controls, lockout/tagout procedures and operator training, the residual risk might drop to low. The hazard has not disappeared. If the light curtain is bypassed or fails, the risk returns.
Residual Risk vs. Inherent Risk
The difference between inherent and residual risk shows how much the controls are doing. A large gap means the hazard relies heavily on controls, so those controls deserve close attention through inspection, maintenance and verification. Controls higher on the hierarchy of controls, such as elimination, substitution and engineering controls, usually provide a more reliable reduction than administrative controls and PPE, which depend on people doing the right thing every time.
How to Rate Residual Risk
Most organizations rate residual risk with the same risk matrix used for inherent risk, scoring likelihood and severity after the controls are applied. A few points to keep in mind:
- Controls usually reduce likelihood more than severity. A guard makes contact less likely, but if contact occurs, the injury can still be severe. Only certain controls, such as lower speeds, lower energy or smaller quantities, reduce severity.
- Be honest about control reliability. A sign or a rule should not drop a rating as much as a fixed guard.
- Rate controls that actually exist. If a control is planned but not yet installed, the current residual risk is still the higher rating.
ALARP and Acceptable Risk
Many organizations judge whether residual risk is low enough using the principle of ALARP, meaning "as low as reasonably practicable." Under ALARP, risk should be reduced until the time, cost and effort of further reduction would be grossly disproportionate to the benefit. ALARP originated in UK law and is widely used in process safety, offshore and engineering risk management. In the United States, ANSI/ASSP Z590.3, the standard on prevention through design, also discusses ALARP and acceptable risk.
A risk is not acceptable simply because a control exists. It is acceptable when it meets the organization's risk criteria, complies with applicable regulations, and further reduction is not reasonably practicable.
Who Should Accept Residual Risk?
Higher residual risk should require sign-off at a higher level of management. A common approach is:
- Low residual risk: accepted by the supervisor or task lead.
- Medium residual risk: accepted by a site or department manager, often with additional monitoring.
- High residual risk: work should not proceed until risk is reduced, or a senior leader formally accepts it with documented justification.
The U.S. Department of Defense system safety standard, MIL-STD-882E, follows a similar idea by requiring formal risk acceptance by authorities at levels matched to the risk. Whatever approach you use, write down who accepted the risk, when and why.
How to Manage Residual Risk Step by Step
- Rate inherent risk. Identify the hazard and rate its likelihood and severity before added controls.
- Select controls. Choose controls starting from the top of the hierarchy of controls.
- Rate residual risk. Re-score the hazard assuming the controls are in place and working.
- Compare to criteria. Check the result against your risk acceptance criteria and legal requirements.
- Reduce further or accept. Add controls if practicable, or obtain formal acceptance from the right level of management.
- Verify controls. Inspect, test and audit controls to confirm they keep working.
- Review regularly. Reassess after incidents, near misses, process changes or a set review interval.
Common Mistakes to Avoid
- Lowering the severity rating because PPE is worn, when the potential injury is unchanged.
- Rating residual risk based on controls that are planned but not in place.
- Treating training and signs as if they were as reliable as engineering controls.
- Never recording who accepted a high residual risk.
- Leaving residual risk ratings unchanged for years despite changes in equipment and people.
How SMS360 Helps
SMS360's Risk Assessment module lets teams record hazards, their controls, and risk ratings before and after controls. Additional controls can be assigned and tracked through Actions Management, and changes that could affect residual risk can be reviewed through the Management of Change module.
Frequently Asked Questions
Can residual risk ever be zero?
Rarely. Unless a hazard is eliminated entirely, some risk usually remains. The goal is to reduce residual risk to an acceptable level and keep it there.
What is the difference between residual risk and inherent risk?
Inherent risk is the risk before controls are applied. Residual risk is the risk that remains after controls are in place. The gap between them shows how much the controls contribute.
Does PPE reduce residual risk?
PPE can reduce the likelihood or extent of injury, but it is the least reliable control because it depends on correct selection, fit and use. Rate it cautiously and do not rely on it alone for high-severity hazards.
How often should residual risk be reviewed?
Review it whenever the task, equipment, people or conditions change, after an incident or near miss, and at a regular interval set by your safety management system.
