Residual Risk

What is Residual Risk?

Residual risk is the "net" risk that your organisation accepts when undertaking work. In the risk management process, you begin by identifying the Inherent Risk (or Gross Risk)—the level of risk present if no controls existed at all. Once you apply treatments such as engineering guards, safety procedures, or personal protective equipment (PPE), the risk reduces. The remaining value is the Residual Risk.

Ideally, your residual risk should align with your organisation's Target Risk (risk appetite). If the residual risk remains higher than your target, the activity is generally considered unsafe to proceed until further controls are implemented.

For Australian duty holders, residual risk is the metric of truth. While inherent risk is a theoretical baseline used to demonstrate the value of controls, residual risk is the operational reality. It determines whether you have met your legal duty to ensure health and safety "so far as is reasonably practicable" (SFAIRP). If a residual risk rating remains "High" or "Extreme," it suggests that you may not have exhausted all reasonably practicable means of risk reduction, or that the activity is inherently too dangerous to continue in its current form.

How it Works

Calculating residual risk is typically a structured process involving your organisation's Risk Matrix.

The Four-Step Process

1. Assess Inherent Risk: Determine the Consequence and Likelihood of a hazard without controls. For example, a fall from heights is "Catastrophic" consequence and "Possible" likelihood = Extreme Risk.

2. Apply Controls: Identify existing or planned controls using the hierarchy of controls. For instance, installing a handrail or safety barrier.

3. Re-Assess Parameters: Consequence often remains the same—a fall is still potentially fatal—though some controls like seatbelts can reduce consequence. Likelihood is drastically reduced by effective controls. For example, a handrail makes a fall "Rare".

4. Determine Residual Score: Plot the new Likelihood and Consequence on the matrix to get the Residual Risk rating, such as Low or Medium.

The Subtraction Model

Many risk systems conceptualise this as:

Residual Risk = Inherent Risk − Control Effectiveness

This highlights that your safety relies entirely on the reliability of your controls. A large gap between Inherent and Residual risk indicates a "high energy" hazard being held back by controls. If those controls fail, the risk snaps back to its Inherent (Extreme) level immediately.

Why it Matters

Understanding residual risk is not just a paperwork exercise—it is a fundamental component of meeting your obligations under the Work Health and Safety (WHS) Act 2011.

Legal Duty (SFAIRP)

Under Section 17 of the Model WHS Act, you must eliminate risks, and where that is not reasonably practicable, minimise them So Far As Is Reasonably Practicable (SFAIRP). Your residual risk rating is evidence of this process.

If you accept a "High" residual risk when a "Low" risk was achievable via a reasonably practicable engineering control, you may be in breach of your primary duty of care.

Officer Due Diligence

Officers (Directors and Executives) have a positive duty under Section 27 to exercise due diligence. This includes ensuring the organisation has processes to minimise risks. Officers cannot rely on a risk register that shows all residual risks as "Green/Low" without interrogation.

You must verify that the residual risk reported matches the reality in the field. Blind reliance on "paper safety" is a failure of due diligence.

Operational Authority

Residual risk dictates who can authorise work. Most Safety Management Systems (SMS) link residual risk to authority levels:

Common Challenges

Optimism Bias

Humans naturally underestimate the likelihood of negative events happening to them. A supervisor might rate the residual likelihood of a vehicle accident as "Rare" because "my team are good drivers," even though industry statistics suggest it is "Possible."

This cognitive bias leads to artificially low residual risk scores, masking the true danger.

The "Paper Safe" Illusion

A common failure mode involves reducing residual risk to "Low" by relying heavily on Administrative Controls such as procedures, training, or signs. In the hierarchy of controls, these are the least effective and most prone to human error.

Case Study: In the inquest into the death of Cameron Cole (2015), the risk of a crushing injury was rated "Medium" based on administrative guidelines. The Coroner found these controls were inadequate for the gravity of the risk. The reliance on procedure rather than engineering controls created a "paper safe" environment that failed in practice.

Risk Entropy

Residual risk is dynamic. A task assessed as "Low Residual Risk" on Monday can become "High Risk" on Wednesday due to rain, fatigue, or equipment wear.

Static risk registers often fail to capture this drift. If you treat residual risk as a fixed number rather than a changing state, you may be working unprotected.

Best Practices

Verify, Don't Just Calculate

Implement Critical Control Verification (CCV). Do not assume a control is reducing risk just because it is listed on a SWMS. Go to the field and test it. Is the guard in place? Is the interlock functioning? If the control isn't working, your residual risk is actually the Inherent Risk.

Prioritise Hierarchy of Controls

Be sceptical of "Low" residual risk ratings achieved solely through administrative controls or PPE. Strive to lower residual risk using Elimination, Substitution, or Engineering controls, which are far more reliable.

Dynamic Risk Assessment

Empower workers to reassess residual risk immediately before starting work using a Take 5 or Job Hazard Analysis (JHA). If conditions change, they must have the authority to stop and recalculate using dynamic risk assessment.

Define "Reasonably Practicable"

Use the SFAIRP test, not just the ALARP (As Low As Reasonably Practicable) triangle. In Australia, even if a risk is "Low," you must still implement further controls if they are inexpensive and easy to install. There is no "Broadly Acceptable" region where you can simply ignore further safety improvements.