What do we call the severity of a risk when the proposed control measures are in place?

The severity of a risk after proposed control measures have been implemented is referred to as residual risk. This term reflects the level of risk that remains after all possible controls, treatments, or measures have been taken to mitigate the initial risk. It recognizes that while risk management strategies can reduce the likelihood and impact of risks, they typically cannot eliminate them entirely. Therefore, after applying controls, the risk that persists is considered the residual risk.

In risk management, understanding residual risk is critical as it indicates the amount of risk that an organization is willing to accept after taking steps to manage the initial risks. This remaining risk must be monitored and managed over time, as it can change due to various internal and external factors.

The other terms listed describe different aspects of risk management. Contingent risk refers to uncertainties that may arise in relation to specific events or conditions, while intrinsic risk relates to the inherent level of risk associated with a particular activity or situation absent any controls. Active risk, often connected to project and financial contexts, refers to risks that are currently being taken on in pursuit of a particular activity or goal. Therefore, while these terms are relevant in risk discussions, they do not specifically identify the risk severity resulting from the application of control measures.