Residual risk vs inherent risk: what is the difference?
Inherent risk is the use case before any controls; residual risk is the same use case after them. NIST defines residual risk as the “portion of risk remaining after security measures have been applied” (NIST CSRC glossary, read 2 November 2026). The gap between the two scores is what your controls are worth, and it is the number a board should ask about.
| Inherent risk | Residual risk | |
|---|---|---|
| When it is scored | Before controls | After controls are in place and tested |
| What drives it | Data, autonomy, who is affected, scale | The same, minus what the controls reliably stop |
| AI example | A support agent that issues refunds on its own | The same agent with a refund cap and human approval above it |
| What it is used for | Deciding which systems need controls first | Deciding whether to sign off and deploy |
| What changes it | Redesigning the use case | Adding, testing or removing controls |
How is residual risk calculated?
The working formula is inherent risk minus the effect of controls, with each scored on likelihood and impact. It is a model, not arithmetic: an untested guardrail reduces nothing. The NIST AI Risk Management Framework asks organizations to document “negative residual risks (defined as the sum of all unmitigated risks)” to buyers and end users under MANAGE 1.4 (NIST AI RMF 1.0, January 2023, read 2 November 2026). Score residual risk per use case, not per model, because the same model carries very different exposure in a drafting tool and in an agent that pays invoices.
What does residual risk look like in an AI system?
Usually small, never zero. A contract assistant grounded in retrieval still produces an occasional hallucination. An agent behind input filters can still meet a novel prompt injection. A tool approval gate catches risky actions, but a tired reviewer can wave one through. Each control leaves a remainder you should be able to name in one sentence, and the list of those sentences is your residual risk register.
Who accepts residual risk, and when?
A named business owner, not the team that built the system. The AIACI AI governance glossary puts it plainly: “A named decision-maker should understand the remaining exposure before approving a deployment or material change” (AIACI AI glossary, read 2 November 2026). Acceptance is a decision with a signature, not a default, and it expires: re-score after a model update, a new data source or wider autonomy, since model drift quietly raises the remainder. Residual risk above your appetite has three exits: add a control, narrow the use case, or stop. AI governance is the place that decision gets recorded, inside wider AI risk management.