Residual Risks and Secondary Risks

Residual risk is the level of risk that remains after all possible measures have been taken to mitigate or eliminate a particular risk.

It is the risk that an event will still occur despite the implementation of risk management controls or strategies.

Residual risk example in banking:

• Inability to clear debt
• Risk of a loan applicant losing their job
• Guarantor's refusal or delay to pay

Here are some steps organizations can take to address residual risk:

• Identify requirements: Determine relevant governance, risk, and compliance requirements.
• Evaluate controls: Assess the strengths and weaknesses of the organization's control framework.
• Acknowledge risks: Recognize existing risks.
• Define risk appetite: Determine the organization's risk tolerance level.
• Implement recovery strategies: Conduct recovery exercises that are realistic and rigorous.
• Transfer risk: Shift the potential loss from an adverse outcome to a third party, such as through purchasing insurance.
• Accept risk: Accept responsibility for any losses incurred by remaining residual risks.

What Are Secondary Risks?

The PMBOK Guide defines secondary risks as “those risks that arise as a direct outcome of implementing a risk response.” In other words, you identify risk and have a response plan in place to deal with that risk. Once this plan is implemented, the new risk that may arise from the implementation - that’s a secondary risk. 

Secondary Risk examples:

• Manufacturing company: A company might offer a promotion to attract more customers for a new product, but this could lead to a secondary risk of running out of inventory.
• Health insurance policy: The premium payments for a health insurance policy are a secondary risk.