Glossary · Management
Residual risk
The level of a risk remaining after controls are applied. It is compared with risk appetite to decide whether further action is needed.
- Field
- Management
- Examined in
- CBA-CRP
- Learning objectives
- 2
Where the CBA Standards examine it
In the specimen paper
At Aravalli Credit, an Indian non-bank lender, the head of collections argues that the risk of lending against unverified income should be scored low, because a second reviewer checks every file before drawdown. What is the correct treatment?
Answer
Score inherent risk before the check, then set residual from tested evidence that it operates.
Why that is the answer
Inherent risk is the exposure before any control is applied; residual risk is what remains once you have tested that the control operates. Keeping the two apart is what allows the register to show what the second review is worth, and to warn you if that review later weakens. Collapse them into one score and you can never take the judgement apart again to see whether the low rating came from a small exposure or a strong control. The keyed option preserves both judgements and ties the second one to evidence rather than to the control's mere existence.
Related terms
- Inherent riskManagement
The level of a risk before any controls are applied.
- Risk appetiteManagement
The amount and type of risk an organisation is willing to accept in pursuit of its objectives, approved by its board.