Search the Elsmar Cove!
**Search ALL of Elsmar.com** with DuckDuckGo Especially for content not in the forum
Such as files in the Cove "Members" Directory

When do we identify Residual Risk?

#11
Yes and no. This is where my confusion comes from. It sounds like some people say residual risk should be estimated up front to show how our controls deal with inherent risk. Other people say that residual risk should be measured after controls have been implemented. There are different scenarios. It seems that when we have existing controls, we should calculate residual risk to see if those controls are already effective to treat new or existing risks. If yes, residual risk should be recorded. If no (no controls or they are not effective), we will need to develop additional risk treatment actions. In this case, it is irrelevant to estimate residual risk because it doesn't seem to add value. See diagram. Why would we estimate it? View attachment 26169

View attachment 26169
Ukrain

Take a look at 31000, check what is in bold

5.5 Risk treatment
5.5.1 General
Risk treatment involves selecting one or more options for modifying risks, and implementing those options.
Once implemented, treatments provide or modify the controls.

Risk treatment involves a cyclical process of:
⎯ assessing a risk treatment;
deciding whether residual risk levels are tolerable;
⎯ if not tolerable, generating a new risk treatment; and
⎯ assessing the effectiveness of that treatment.
Risk treatment options are not necessarily mutually exclusive or appropriate in all circumstances. The options
can include the following:
a) avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk;
b) taking or increasing the risk in order to pursue an opportunity;
c) removing the risk source;
d) changing the likelihood;
e) changing the consequences;
f) sharing the risk with another party or parties (including contracts and risk financing); and
g) retaining the risk by informed decision.

Additionally:

In 2.27
residual risk
risk (2.1) remaining after risk treatment (2.25)

Hope this helps
 
Top Bottom