--- title: Residual Risk Calculation Examples for BCM Teams description: See five residual risk calculation examples showing how test results, control gaps, and other evidence can change likelihood and impact ratings. image: https://bcmmetrics.com/hubfs/Residual%20Risk%20Calculation%20Examples%20for%20BCM%20Teams.png --- [Skip to content](https://bcmmetrics.com/blog/residual-risk-calculation-evidence-examples#main-content) SOLUTIONS [PRICING](https://bcmmetrics.com/pricing) USE CASES RESOURCES [ABOUT US](https://bcmmetrics.com/about-bcmmetrics) Flexible BCM software solutions [See all solutions →](https://bcmmetrics.com/business-continuity-solutions) [![Group 1171274363](https://bcmmetrics.com/hubfs/Group%201171274363.svg) **REGULATORY COMPLIANCE** A self-assessment tool to evaluate the level of compliance of your business continuity program](https://bcmmetrics.com/business-continuity-solutions/compliance-confidence) [![Frame 16367](https://bcmmetrics.com/hubfs/Frame%2016367.svg) **BUSINESS CONTINUITY PLANNING** A single platform where you can build and share business continuity plans (BCPS) across your entire team](https://bcmmetrics.com/business-continuity-solutions/bcm-planner) [![Frame 16365](https://bcmmetrics.com/hubfs/Frame%2016365.svg) **BUSINESS IMPACT ANALYSIS** An everyday business impact analysis (BIA) software to help you prepare and plan for anything](https://bcmmetrics.com/business-continuity-solutions/bia-on-demand) [![Group 1171274403](https://bcmmetrics.com/hubfs/Group%201171274403.svg) **FACILITIES MANAGEMENT** An intuitive icon-based mapping tool to better manage your facilities around the globe](https://bcmmetrics.com/business-continuity-solutions/bcm-one) [**INSURANCE** Identify critical systems and create streamlined response plans](https://bcmmetrics.com/industry/insurance) [**HEALTHCARE** Simplify compliance and risk assessments in one platform](https://bcmmetrics.com/industry/healthcare) [**FINANCE** Manage audits and meet standards with ease](https://bcmmetrics.com/industry/finance) [**![case-studies](https://bcmmetrics.com/hubfs/Website%20Images/Global/case-studies.svg) CASE STUDIES** Learn how others have redefined their BC management with BCMMetrics](https://bcmmetrics.com/business-continuity-case-studies) [**![case-studies](https://bcmmetrics.com/hubfs/Website%20Images/Global/resource-library.svg) RESOURCE LIBRARY** Access our collection of free downloadable resources](https://bcmmetrics.com/business-continuity-resources) [**![case-studies](https://bcmmetrics.com/hubfs/Website%20Images/Global/blog.svg) BLOG** Read along for expert BC advice from our senior consultants](https://bcmmetrics.com/blog) [LOG IN](https://app.bcmmetrics.com/Portal/login.aspx) [VIRTUAL TOUR](https://bcmmetrics.com/virtual-tour-form) [BOOK YOUR DEMO](https://bcmmetrics.com/demo) ![Mask group (7)](https://bcmmetrics.com/hubfs/Mask%20group%20(7).png) ![Mask group (6)](https://bcmmetrics.com/hubfs/Mask%20group%20(6).png) # Residual Risk Examples for Business Continuity Teams Michael Herrera Published on: August 05, 2026 ### Prepare For the Worst with the Best in the Business Experience capable, consistent, and easy-to-use business continuity management software. [BOOK YOUR DEMO](https://bcmmetrics.com/demo) Residual risk should be recalculated when new evidence changes what your team knows about a control. A completed test may support a lower likelihood rating. A failed exercise, missing supplier evidence, or incomplete remediation may justify a higher one. There is no universal residual risk calculation. These hypothetical examples use a simple likelihood and impact model to show the reasoning. They are not customer records, recommended thresholds, or benchmarks. **In short** - Reassess the same disruption scenario before and after current controls. - Give each control only the credit its evidence can support. - Explain whether the control changes likelihood, impact, duration, or the team’s confidence in the rating. - Record the evidence, rationale, decision, owner, and next review trigger. ## Use Evidence to Reassess Likelihood and Impact [NIST defines residual risk](https://csrc.nist.gov/glossary/term/residual_risk) as risk remaining after controls or risk responses are applied. The practical question is how much those controls change the original exposure. ### An Illustrative Calculation Method The examples use this model: **Residual risk score = reassessed likelihood × reassessed impact** Likelihood and impact are each scored from 1 to 5. Use the same scenario and scale for the inherent and residual assessments. Your organization must define its rating bands, tolerance levels, and approval authority. This is an illustration, not a standard formula. [NIST SP 800-30 Rev. 1](https://csrc.nist.gov/pubs/sp/800/30/r1/final), published in September 2012, discusses likelihood, impact, and uncertainty but does not require this multiplication model. For more background, read the BCMMetrics guide to [residual risk meaning and calculation](https://bcmmetrics.com/blog/what-is-residual-risk). ### How Much Credit Should a Control Receive? Evidence is not a number to subtract from inherent risk. It tells you how much confidence you can place in the control when you reassess likelihood and impact. - **Current test evidence:** Credit the control for the part of the scenario it covered. - **Partial evidence:** Keep uncovered processes, locations, periods, and dependencies visible. - **Outdated evidence:** Consider what changed before carrying the old rating forward. - **Contradictory evidence:** A failure or missed objective should change the assumptions behind the rating. - **No retrievable evidence:** Do not assume failure, but do not credit the control as though it were demonstrated. [![bcmmetrics-logo-new-white](https://no-cache.hubspot.com/cta/default/46578083/interactive-215178222355.png)](https://bcmmetrics.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJdeBJINtXVF%2FyJn1F6KwF8oLCcZ4Tqw8RM3sVelPUKIfUHN%2BzU9ZLsDtpdqEUUjbMPCkYdu8mzwKWM%2BEzI6cwPqNft%2F%2FtR7CtvJALAO4SIvSsTdY3ZYe%2BsMqN5%2FxYjtEuKnHO7LvdYHm3Oq1iGHtTz2lXkoD0o%2F96lfCmIiNI5KXKy3V2MuWV5BtHctyaO3wKCNjHew7f8YTeWi7lRYbL7rRqRQBKFKCV4gBSo&webInteractiveContentId=215178222355&portalId=46578083) ## Five Residual Risk Calculation Examples The numbers illustrate the logic. Do not copy them into a risk register without the organization’s approved definitions and criteria. ### 1. A Control That Works but Does Not Remove the Impact **Scenario:** A payment platform becomes unavailable during a daily settlement window. **Inherent risk:** Likelihood 5 × impact 5 = 25. **Evidence:** A recent failover test restored processing within the required time. The test covered the internal platform and external settlement connection. **Residual risk:** Likelihood 2 × impact 5 = 10. **Why it changed:** The test supports a lower likelihood of prolonged interruption. Missing the settlement window would still have a severe impact. ### 2. A Recovery Test That Exposes a Capability Gap **Scenario:** A critical application must be recovered within four hours. **Previous residual risk:** Likelihood 2 × impact 5 = 10, based on a documented procedure and assumed four-hour capability. **New evidence:** The latest test took seven hours. Data validation added two hours that were not included in the procedure. **Revised residual risk:** Likelihood 3 × impact 5 = 15. **Why it changed:** The test contradicts the earlier likelihood assumption. The business impact has not changed. ### 3. A Third-Party Control Without Sufficient Evidence **Scenario:** A single-source supplier is disrupted for more than ten business days. **Inherent risk:** Likelihood 4 × impact 4 = 16. **Claimed control:** The supplier says it can move production to another facility. **Evidence:** The contract mentions alternate production, but there is no current capacity confirmation, test result, or recovery commitment for the required volume. **Residual risk:** Likelihood 4 × impact 4 = 16. **Why it did not change:** The control may exist, but the evidence does not support reducing likelihood or impact. The next step is to obtain evidence, not assume success or failure. ### 4. An Exercise Finding That Changes the Rating **Scenario:** An electronic health-record outage disrupts clinical workflows. **Previous residual risk:** Likelihood 2 × impact 4 = 8, based on documented downtime procedures and completed training. **Evidence:** An exercise found that two outpatient departments could not access current forms or reconcile records after restoration. **Revised residual risk:** Likelihood 3 × impact 4 = 12. **Why it changed:** The control did not operate consistently across the defined scope. Reassess after the forms, training, and reconciliation steps are corrected and tested. ### 5. A Compliance Gap With Partial Remediation **Scenario:** The BCM program cannot show current approval and exercise evidence for all critical plans. **Inherent risk:** Likelihood 4 × impact 3 = 12. **Evidence:** A new review process is documented, and 70 percent of critical plans have current approvals. Exercise evidence is complete for half of those plans. **Residual risk:** Likelihood 3 × impact 3 = 9. **Why it changed:** Completed approvals support some reduction, but implementation and exercise evidence remain incomplete. Reassess after the remaining work is verified. ## Document Why the Rating Changed A recalculated score without its reasoning is difficult to defend. Keep this information with each reassessment: - The exact scenario and the likelihood and impact definitions used - The previous rating and date - The control being credited - The evidence reviewed, including its date and scope - The new likelihood and impact ratings - A short explanation of what changed and what did not - The treatment or acceptance decision - The owner, approver, open action, and next review trigger The rating and the decision remain separate. Residual risk describes the exposure after controls. Acceptance is the authorized decision to retain that exposure. MHA Consulting’s guide to [risk acceptance versus residual risk](https://mha-it.com/blog/risk-acceptance-strategy) addresses that governance decision in more depth. For the audit record behind the calculation, see [Residual Risk Documentation for Audit](https://bcmmetrics.com/blog/residual-risk-documentation-audit-evidence-owners-review-cadence). ## Keep the Assessment and Evidence Connected A spreadsheet can hold two scores and a formula. The harder job is keeping evidence, actions, and assessment history connected as conditions change. [BCMMetrics Compliance Confidence](https://bcmmetrics.com/business-continuity-solutions/compliance-confidence) supports standards-based assessments, supporting documents, assigned actions, assessment history, and reporting. It does not decide how much risk the organization should accept. It gives the team a more consistent place to maintain the information behind that decision.   [![bcmmetrics-new-logo-navy](https://no-cache.hubspot.com/cta/default/46578083/interactive-212390670376.png)](https://bcmmetrics.com/hs/cta/wi/redirect?encryptedPayload=AVxigLKoI3H3AZVH0gXzqDD%2FBPcchbjNxaUZ6p1kqxo4v8cXKsWMCq%2FhxCgZ6uYfIHAY0VdVOnGunb1x4LHuNz6MbTTAV9Cqij6pXMMQ2xZ8ZDyg2BjSrt3FTRVTYzjDW%2BvoOp7wvxBxeb2LVHqYwquFFaprYPBDwYkz9HaXtlr2w%2B265lcemUpfFswRhGdJzbtYOSQHy83vDz%2BIJ7JV%2Fv34NQ%3D%3D&webInteractiveContentId=212390670376&portalId=46578083) ## Frequently Asked Questions ### What is a residual risk calculation? It estimates the exposure remaining after current controls are considered. One illustrative method reassesses likelihood and impact, then multiplies the scores. Organizations still need their own definitions and criteria. ### Does missing evidence automatically mean a control is ineffective? No. Missing evidence creates uncertainty. Give the control only the credit that can be supported, then obtain current evidence through testing, document review, or supplier validation. ### When should residual risk be recalculated? Recalculate it when new evidence could change the assumptions behind the rating. Common triggers include tests, exercises, incidents, control changes, overdue actions, supplier changes, new requirements, and material changes to the affected process or technology. --- ![](https://bcmmetrics.com/hubfs/Website%20design/Michael-Herrera-MHA-Consulting.jpg) #### Michael Herrera Michael Herrera is the Chief Executive Officer (CEO) of MHA. In his role, Michael provides global leadership to the entire set of industry practices and horizontal capabilities within MHA. Under his leadership, MHA has become a leading provider of Business Continuity and Disaster Recovery services to organizations on a global level. He is also the founder of BCMMETRICS, a leading cloud based tool designed to assess business continuity compliance and residual risk. Michael is a well-known and sought after speaker on Business Continuity issues at local and national contingency planner chapter meetings and conferences. Prior to founding MHA, he was a Regional VP for Bank of America, where he was responsible for Business Continuity across the southwest region. ## Other resources you might enjoy ![Enterprise Risk Management](https://bcmmetrics.com/hs-fs/hubfs/Imported_Blog_Media/getting-started-with-enterprise-risk-management.jpg?height=245&name=getting-started-with-enterprise-risk-management.jpg) #### [Getting Started with Enterprise Risk Management](https://bcmmetrics.com/blog/getting-started-with-enterprise-risk-management) Michael Herrera [Read More](https://bcmmetrics.com/blog/getting-started-with-enterprise-risk-management) ![](https://bcmmetrics.com/hs-fs/hubfs/Residual%20Risk%20Documentation%20for%20Audit.png?height=245&name=Residual%20Risk%20Documentation%20for%20Audit.png) #### [Residual Risk Documentation for Audit: Evidence, Owners, Review Cadence](https://bcmmetrics.com/blog/residual-risk-documentation-audit-evidence-owners-review-cadence) Theron Long [Read More](https://bcmmetrics.com/blog/residual-risk-documentation-audit-evidence-owners-review-cadence) ![Residual Risk](https://bcmmetrics.com/hs-fs/hubfs/Blog%20images/November%20-%20December%202024/What-Is-Residual-Risk-and-How-Do-You-Calculate-It.webp?height=245&name=What-Is-Residual-Risk-and-How-Do-You-Calculate-It.webp) #### [What Is Residual Risk (and How Do You Calculate It)?](https://bcmmetrics.com/blog/what-is-residual-risk-and-how-to-calculate-it) Michael Herrera [Read More](https://bcmmetrics.com/blog/what-is-residual-risk-and-how-to-calculate-it) ## Ready to start focusing on higher-level challenges? ### ![Group 1171274345](https://bcmmetrics.com/hubfs/Website%20Images/Footer/bcmmetrics-logo-new-white.svg) 3820 W Happy Valley Road Glendale, AZ 85310 USA [SOLUTIONS](https://bcmmetrics.com/business-continuity-solutions) - [Regulatory Compliance](https://bcmmetrics.com/business-continuity-solutions/compliance-confidence) - [Business Impact Analysis](https://bcmmetrics.com/business-continuity-solutions/bia-on-demand) - [Business Continuity Planning](https://bcmmetrics.com/business-continuity-solutions/bcm-planner) - [Facilities Management](https://bcmmetrics.com/business-continuity-solutions/bcm-one) PRICING - [Our Pricing Model](https://bcmmetrics.com/pricing) RESOURCES - [Case Studies](https://bcmmetrics.com/business-continuity-case-studies) - [Resource Library](https://bcmmetrics.com/business-continuity-resources) - [Blog](https://bcmmetrics.com/blog) COMPANY - [About us](https://bcmmetrics.com/about-bcmmetrics-old) - [Contact](https://bcmmetrics.com/demo) - [MHA Consulting](https://www.mha-it.com/) © 2026 BCMMetrics. All rights reserved. [Privacy Policy](https://bcmmetrics.com/privacy-policy) ```json { "@context" : "", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://bcmmetrics.com", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://bcmmetrics.com/blog", "name" : "Blog", "position" : 2 }, { "@type" : "ListItem", "name" : "Residual Risk Examples for Business Continuity Teams", "position" : 3 } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Michael Herrera", "url" : "https://bcmmetrics.com/blog/author/michael-herrera" }, "dateModified" : "2026-08-05T12:43:39.236Z", "datePublished" : "2026-08-05T12:43:39.000Z", "headline" : "Residual Risk Calculation Examples for BCM Teams", "image" : [ "https://bcmmetrics.com/hubfs/Residual%20Risk%20Calculation%20Examples%20for%20BCM%20Teams.png" ], "mainEntityOfPage" : { "@id" : "https://bcmmetrics.com/blog/residual-risk-calculation-evidence-examples", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://bcmmetrics.com/hubfs/Group%201171274345.svg" } } } ```