3.4 Residual Risk, Suitable & Sufficient, Review

3.4 Residual Risk, Suitable & Sufficient, Review

Quick Answer: Residual risk is what is left after controls are applied. Reduce it so far as is reasonably practicable until the remaining risk is acceptable. Keep assessments suitable and sufficient, review them when work or knowledge changes, and record significant findings — a clear expectation when you employ five or more people.

Assessing risks does not end when you write a number on a form. Managers must judge whether the risk that remains is tolerable, whether the assessment itself is good enough, when to revisit it, and how to document findings so the organisation can act.

Residual risk defined

Residual risk = the risk that remains after control measures have been put in place.

Contrast:

In Managing Safely project language you typically:

1. Rate current risk (existing controls) with L × C
2. Propose additional controls
3. Rate residual risk with a new L × C
4. Confirm residual is lower and acceptable for the work to proceed

Example

• Hazard: solvent cleaning in a small booth
• Current controls: gloves only; poor ventilation
• Current rating: L4 × C3 = 12 (action band)
• Additional controls: local exhaust ventilation, correct respirator for short residual exposure, training, spill procedure, supervision
• Residual rating: L2 × C3 = 6 (monitor band)

Likelihood fell because exposure is better controlled; consequence may stay moderate if a failure still causes harm. That pattern is normal.

What residual risk is not

• Not "risk transferred to the insurer"
• Not "risk that only nature can cause"
• Not automatically zero because a procedure exists on paper
• Not acceptable merely because reducing it further would be inconvenient

Reducing residual risk to an acceptable level

UK health and safety law and Managing Safely teaching align on a practical goal: reduce risk so far as is reasonably practicable (often discussed as balancing the level of risk against the time, trouble, and cost of further control). Related ideas you will meet in the controlling-risks chapter include ALARP language and the ERICPD hierarchy.

For managers, residual risk is acceptable when:

• Significant foreseeable risks are controlled in line with good practice and legal duties
• Higher-priority hierarchy controls have been considered (eliminate/reduce before relying on PPE)
• Remaining risk is understood, communicated, and monitored
• Further reduction would be grossly disproportionate to the extra benefit (for higher-stakes judgements, seek competent advice)

Zero residual risk is rarely achievable for real work. The exam trap is claiming every risk must be eliminated completely before any work can start, or the opposite trap — accepting high residual scores without improvement.

Manager questions after controls

1. Did L or C (or both) actually fall for a credible reason?
2. Are the new controls implemented, not just proposed?
3. Who checks they keep working?
4. What residual scenarios remain (maintenance, failure of LEV, contractors on site)?
5. Is a safe system of work or permit required because residual risk is still significant?

Suitable and sufficient — the quality test

A risk assessment must be suitable and sufficient. This is core legal and syllabus language. It does not mean perfect, endless, or written only by consultants.

Making assessments suitable in practice

• Match depth to risk: a low-risk office move needs less detail than hot work in a live plant.
• Use competence: managers assess their areas; call in specialists for complex health risks, structural issues, or major hazard processes.
• Involve workers: suitability improves when people who do the job contribute.
• Reflect reality: controls described must be ones you can evidence (training records, inspection of guards, maintenance schedules).
• Stay current: an assessment that ignores last month's new line is no longer sufficient.

Review triggers

Review is step 5 of the five-step process and the way residual risk stays under control as the workplace evolves.

Exam point: reviews are not only every five years, only after inspector visits, or never once signed. They are event-driven and time-driven.

Setting review dates

• Higher residual risk or rapidly changing work → shorter review cycles
• Stable, low-risk activities → longer cycles (often annual is used as a default in many organisations)
• Always review early if a trigger fires, regardless of the calendar date

Write a real date on the assessment and diary it. On the Managing Safely project, a realistic review date (for example 12 months for a stable activity) is part of completing the form properly.

Written records — five or more employees

The course teaches the UK principle from the Management of Health and Safety at Work framework: if you employ five or more people, you must record the significant findings of your risk assessment.

Record at least:

• Significant hazards
• Who might be harmed and how
• Controls in place and further actions
• (Good practice) owners, timescales, residual risk judgements, review date

Even below five employees, simple records are wise, and many clients, principal contractors, and insurers require them. Recording is for communication and memory, not for creating a false sense of safety. HSE emphasises controlling risks in practice over pure paperwork.

What "significant findings" means

You do not need a novel. You need enough that a colleague covering your area could understand the main dangers, the people at risk, and the controls expected. Trivial issues that require no action beyond everyday care may not need elaborate write-up; significant risks do.

Putting it together — a manager's close-out loop

1. Complete the five steps for the activity.
2. Score current risk on the 5×5 matrix.
3. Apply / improve controls using hierarchy thinking.
4. Score residual risk; judge acceptability.
5. Record significant findings (especially at 5+ employees).
6. Assign monitoring owners and review dates.
7. Re-enter the loop when triggers fire.

This loop is exactly what high-scoring project submissions demonstrate and what competent day-to-day management looks like.

Exam traps for this section

Bridge to the next chapter

Once residual risk is still too high, or even when it is tolerable, you need a structured way to choose controls. The next chapter — Controlling Risks — covers the ERICPD hierarchy, what reasonably practicable means in more depth, safe systems of work, and permits for high-risk tasks. Assessing risks tells you what matters and how big it is; controlling risks tells you how to bring residual risk down.