Free resource: 24-point supplier-selection checklistOpen checklist

Procurement glossary

Residual risk

Residual risk is the exposure that remains after existing controls and mitigations are considered.

Published 23 July 2026Substantively updated 23 July 2026
Definition: Residual risk is the exposure that remains after existing controls and mitigations are considered.

Why it matters in supplier selection

A supplier may have high inherent risk but manageable residual risk if effective controls are verified. Conversely, an apparently moderate issue may remain unacceptable when controls are weak or unproven.

Practical example

A supplier has single-site production risk. A tested recovery plan and alternate capacity reduce the exposure, but a medium residual continuity risk remains and should be visible in the award conditions.

Fictional example: the figures or scenario are illustrative and do not describe a real supplier or client outcome.

How to use the term in a decision record

State the definition, source data, owner and decision treatment clearly. Do not use the term as shorthand for an undocumented assumption. Where the concept affects a score, cost or risk result, preserve the formula or evidence reference and the version date.

Next step

Move from supplier data to an approvable decision.

Review the sample output, then choose the licence that matches your intended use.

Download sample