Residual Risk

Residual risk is the risk that remains after risk responses, controls or mitigation strategies have been applied. It is what is left once a buyer, project team or security authority has done what it plans to do about a risk. The term is used in enterprise, project, information-security, defence and procurement risk management.

The idea fits the approach in ISO 31000, which defines risk as the effect of uncertainty on objectives and sets out general principles and guidelines for managing it (ISO 31000). In Canadian public procurement, residual risk appears in Treasury Board guidance, in reviews by the Office of the Procurement Ombudsman, and in NATO security-risk documentation.

Residual risk versus inherent risk in Government of Canada guidance

The Government of Canada defines residual risks as the risks remaining after mitigation strategies have been put in place. The same guidance defines inherent risks as the risks present before mitigating strategies are developed or applied. Read together, the two terms describe a before-and-after picture: inherent risk is the starting exposure, and residual risk is the exposure that stays after controls are in place. Both definitions appear in the Project Complexity and Risk Assessment guidance published by the Treasury Board of Canada Secretariat.

Where residual risk appears in project and procurement planning

The Project Complexity and Risk Assessment (PCRA) guidance uses residual risk in project and procurement planning. It identifies procurement as a project-risk category and states that procurement can increase cost and scope-management complexity and risk. It also names vendor selection, contract award and vendor-management controls as relevant procurement-risk considerations.

For a project team, this means a procurement risk is not judged only on how serious it looks at the outset. The team considers the mitigation strategies it will apply, then looks at what remains. Those remaining risks are the residual risks the project carries into the solicitation and the resulting contract (PCRA guidance).

How the Procurement Ombudsman assesses residual risk

The Office of the Procurement Ombudsman (OPO) uses residual risk when it plans reviews of federal procurement practices. Its Procurement Practice Review Plan first considers whether controls mitigate procurement risks, then evaluates the residual risk for each procurement element. The elements it lists include planning and strategy, solicitation, bid-evaluation and selection plans, evaluation of bids, contract amendments and debriefings (OPO review plan).

Shared Services Canada also builds residual risk into its procurement governance. It uses a Procurement Summary Risk Assessment and related oversight mechanisms, and a 2026 OPO report states that the framework was intended to trigger committee oversight when the residual-risk value exceeded an established threshold.

Residual risk in NATO security-risk management

NATO information-security guidance calls for a security-risk management report. That report includes the countermeasures to be implemented and a description of residual risk (NATO security policy document). Residual risk is therefore documented after safeguards or countermeasures are selected, so decision-makers can see what exposure they are accepting. NATO's official terminology database, NATOTerm, contains non-classified military and non-military terminology relevant to NATO.

What residual risk means for a supplier bidding on Canadian public contracts

A reference to residual risk usually concerns the buyer's own risk assessment and the controls the buyer requires in the solicitation or contract. It describes how the buyer thinks about exposure. It is not, on its own, a supplier obligation.

• Any duty placed on a supplier comes from the specific solicitation, security requirement, statement of work, contract clause or assurance regime.
• Controls in a solicitation often reflect risks the buyer has chosen to mitigate, so reading them closely shows where the buyer sees exposure.
• Areas the PCRA and OPO materials treat as risk-sensitive include vendor selection, bid evaluation, contract award, contract amendments and debriefings.

Bid teams should respond to the requirements as written and not assume that the words "residual risk" create a Canada-wide supplier duty.