You found a hazard, you added controls, and the job feels safer. But how much safer? Residual risk is the answer. It is the risk that is still there after your controls are in place, and it is what you have to live with.
Enter your scores before and after the controls below, and the calculator will show the change.
What is residual risk?
Residual risk is the level of risk that remains after you have applied your safety controls. No control removes every risk, so there is almost always something left. Your job is to make sure what is left is small enough to accept.
The risk you start with, before any controls, is called the inherent risk. Some people call it the initial risk. The difference between the two numbers shows how well your controls are working.
The residual risk formula
Both risks are scored the same way, using likelihood and severity:
Risk score = Likelihood x Severity
Then you compare the two scores to see how much the risk came down:
Risk reduction (%) = ((Inherent risk – Residual risk) / Inherent risk) x 100
Use the same scale for both scores. If you use a 5×5 matrix for the first one, use it for the second one too.
Worked example
A warehouse worker lifts 25 kg bags of cement by hand, up to shoulder height, many times a day.
Before controls: an injury is likely, so likelihood is 4. A back injury could mean time off work, so severity is 3.
Inherent risk = 4 x 3 = 12, which is high.
The company adds a pallet lifter and a trolley, and changes the stack height. Bags are now moved with equipment for most of the trip. The chance of injury is lower, so likelihood drops to 2. The harm, if it did happen, would still be a back injury, so severity stays at 3.
Residual risk = 2 x 3 = 6, which is medium.
Risk reduction = ((12 – 6) / 12) x 100 = 50%
The controls cut the risk in half. The team can now decide whether a score of 6 is acceptable, or whether more is needed, such as smaller bags.
Why severity often stays the same
Most controls lower the chance of harm. They do not reduce how bad the harm would be if something still went wrong. A guard on a machine makes contact less likely, but contact would still hurt just as much. So in most cases, likelihood falls and severity stays put.
The exception is when you change the hazard itself, for example by using a lighter material, a lower voltage or a less harmful chemical. That kind of change can bring severity down as well, and it is usually the best kind of control.
The hierarchy of controls
When you plan your controls, work from the strongest to the weakest:
- Eliminate: remove the hazard completely
- Substitute: replace it with something less dangerous
- Engineering controls: guards, barriers, ventilation, lifting aids
- Administrative controls: procedures, training, signs, job rotation
- PPE: gloves, helmets, masks and harnesses, as the last line of defence
Controls near the top of the list are more reliable, because they do not depend on people remembering to do the right thing every time.
Is your residual risk acceptable?
Once you know the number, you have to decide if it is low enough. Many companies use a simple rule: residual risk should fall into the green or yellow band of the matrix before work goes ahead. Anything orange or red needs more controls or management approval.
Some use the idea of ALARP, which means as low as reasonably practicable. It asks you to keep adding controls until the cost, time or effort of doing more is far out of proportion to the small gain in safety. Your own policy, your client and the law in your area decide the final line.
Step by step
- Score the hazard as it is today, with no extra controls. This is the inherent risk.
- List the controls you plan to add, from strongest to weakest.
- Check that each control is really in place, not just planned.
- Score the hazard again. This is the residual risk.
- Work out the percent reduction.
- Decide if the result is acceptable, and record who approved it.
Check that your controls actually work
A control on paper is not a control on site. A guard that is removed, a procedure that nobody reads or a harness that is never worn does not lower the risk at all. Walk the site and see for yourself. Ask workers whether the control is practical. If it slows the job too much, people will find a way around it, and your residual score will be wrong.
Common mistakes
- Counting controls that are planned but not yet in place
- Lowering severity when the possible harm is exactly the same
- Using different scales for the before and after scores
- Relying only on training and PPE when stronger options exist
- Forgetting to review the residual risk after a change in the job
- Accepting a high residual score without anyone senior signing it off
Using it with your other tools
Start with the risk matrix calculator to get the inherent score. For machines and processes, the RPN calculator can show the same before and after change. For strain from lifting and repetitive work, the ergonomic risk calculator is a useful first check.
Frequently asked questions
What is the difference between inherent and residual risk?
Inherent risk is the risk before any controls. Residual risk is what remains after the controls are in place.
Can residual risk be zero?
Almost never. Even a good set of controls leaves a small amount of risk, so the aim is to make it acceptable.
Why is my residual risk higher than I expected?
Your controls may only reduce likelihood and not severity, or they may not be fully in place. Check both.
How do I work out the percent reduction?
Subtract the residual score from the inherent score, divide by the inherent score, and multiply by 100.
Who should approve the residual risk?
That depends on your company. Low scores can be signed off by a supervisor, while high scores usually go to a manager.
Learn this properly
Residual risk and the hierarchy of controls are covered in NEBOSH, IOSH and OSHA courses. ISH Institutes teaches these in Peshawar. Chat with us on WhatsApp and we will help you pick the right course.