Residual risk

Residual risk is what is still left after you have done everything you are going to do about something.

There is always some. The point of naming it is that it should be a decision rather than an accident. Somebody senior enough to carry it should have seen the number, understood what it means and said yes, that is acceptable. What happens more often is that residual risk is simply whatever is left over once the budget ran out, written down afterwards, and nobody has actually agreed to live with it until the day it happens.

Checked against the primary source.

More on Security fundamentals