Restrisikos

Restrisikos is a term used in risk management to describe the level of risk that remains after controls and mitigation measures have been implemented. It represents the portion of threat and impact that cannot be eliminated entirely because of practical limitations, costs, inherent uncertainties, or the residual risk accepted as part of business objectives. In many frameworks, restrisiko is contrasted with inherent risk (the risk before controls) and with risk treatment (the measures applied to reduce risk).

The assessment of restrisikos involves evaluating how effective existing controls are in reducing likelihood and/or impact. It is commonly expressed in qualitative terms (for example low, medium, high) or through quantitative metrics such as probability times consequence. Because uncertainties persist, restrisikos is often treated as an ongoing governance concern rather than a one-off calculation. Standards such as ISO 31000 encourage documenting the risk, the controls in place, the residual level, and the rationale for accepting any remaining risk.

Management of restrisikos includes monitoring changes in the risk environment, re-evaluating controls, and deciding on risk appetite and tolerance. If the residual risk exceeds acceptable levels, organizations may pursue additional controls, alter processes, transfer risk (for example through insurance or contracts), or formally accept the risk at the appropriate governance level.

Examples appear across domains: in information security, restrisikos may persist after implemented safeguards; in project management, residual risks can arise from budget, schedule, or technical uncertainties; in health and safety, some hazards remain despite preventive measures.