Chapter 24 — Security governance, risk and compliance: methods I
Lesson map
Lesson 24 published. Map, example, EX070.
flowchart TD
N0["Learning outcomes"]
N1["24.1 Inherent and residual"]
N2["24.2 Calculating residual"]
N3["Lab — Inherent and residual risk with control effect"]
N4["24.3 Interpreting residuals"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX070"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["24.1 Inherent and residual"]
N2["24.2 Calculating residual"]
N3["Lab — Inherent and residual risk with control effect"]
N4["24.3 Interpreting residuals"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX070"]
[Learning outcomes]
|
v
[24.1 Inherent and residual]
|
v
[24.2 Calculating residual]
|
v
[Lab — Inherent and residual risk with control effect]
|
v
[24.3 Interpreting residuals]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX070]
Learning outcomes
You will (1) distinguish inherent and residual risk; (2) estimate residual risk from control effectiveness; (3) recognise risks with no treatment.
24.1 Inherent and residual
Inherent risk is the risk before considering controls; residual risk is what remains after them. Nadia learns that the distinction helps boards see what controls achieve and where risk remains above appetite. ISO/IEC 27005:2022 describes risk analysis and evaluation within the management system and expects organisations to decide on treatment and accept residual risks formally. For Ardwell she estimates inherent expected loss for four risks in thousands and the effectiveness of each control as the fraction of loss it removes. Expressing control effectiveness as a fraction of loss removed makes the residual calculation in the next section possible.
24.2 Calculating residual
The lab multiplies inherent loss by one minus each control's effectiveness, assuming controls act independently. Ransomware falls from ninety thousand to about twenty-two thousand, a reduction of seventy-six percent, through backups and endpoint detection. Billing outage halves from sixty to thirty thousand through failover. Card breach falls from seventy-five to about eleven thousand, an eighty-six percent reduction, through tokenisation and segmentation. Vendor misuse stays at eighty thousand because no control treats it, making it the largest residual risk. Vendor misuse at eighty thousand now exceeds every treated risk, although its inherent loss was below ransomware's ninety thousand.
Lab — Inherent and residual risk with control effectiveness
"""Inherent vs residual risk with control effectiveness (synthetic, ALE in thousands)."""
risks = {"ransomware": (90, [("offline backups", 0.6), ("EDR", 0.4)]),
"billing outage": (60, [("failover", 0.5)]),
"card breach": (75, [("tokenisation", 0.8), ("segmentation", 0.3)]),
"vendor misuse": (80, [])}
for r, (inh, ctl) in risks.items():
res = inh
for _, e in ctl: res *= (1 - e)
print(f"{r}: inherent {inh}k residual {res:.1f}k reduction {1-res/inh:.0%}")
Run with python3 lab_residual.py. Verified output:
ransomware: inherent 90k residual 21.6k reduction 76%
billing outage: inherent 60k residual 30.0k reduction 50%
card breach: inherent 75k residual 10.5k reduction 86%
vendor misuse: inherent 80k residual 80.0k reduction 0%
24.3 Interpreting residuals
The lab changes the order of risks. Ransomware ranked first inherently, but vendor access misuse ranks first in residual terms because it is untreated. Nadia recommends that treatment of vendor access becomes a priority. She also notes the independence assumption may overstate combined effectiveness, since backups and detection might fail together in a well-planned attack. Effectiveness figures are estimates from workshops and should be checked with testing evidence over time, as later chapters on measurement will show. Workshop estimates such as the seventy-six percent ransomware reduction should be revisited once restore tests and detection tests produce data.
Worked example
Nadia computes residual losses, finds vendor misuse untreated at eighty thousand and recommends treating it first.
Synthetic case. Losses and effectiveness values are synthetic; ISO/IEC 27005:2022 is real.
Errors and limits
Independence overstates combined effect. Effectiveness estimates are subjective.
Exercises
- EX070 — Residual definition. How does residual risk differ from inherent risk? Rubric: 3 = it remains after controls;; 2 = after controls;; 1 = before;; 0 = none.
- EX071 — Ransomware residual. By how much did controls reduce ransomware loss in the lab? Rubric: 3 = 76%, to 21.6k;; 2 = 76%;; 1 = vague;; 0 = none.
- EX072 — Largest residual. Which risk had the largest residual loss and why? Rubric: 3 = vendor misuse at 80k, untreated;; 2 = vendor;; 1 = ransomware;; 0 = none.
Synthesis
Residual risk shows what controls achieve and exposes untreated risks for priority action.
Continue studying — chapter 24 of 50
← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →