[This is the second post in our occasional series “You’re Doing It Wrong.” The first post was on BCM Metrics.]

I realize that the title of this post is probably incorrect. It’s probably not right to say that you are using residual risk incorrectly in your business continuity program.

Most likely you are not using it at all!

That is, if my experience with industries of all types across the country is representative of the general situation of leading American businesses and nonprofits, and I think it is. (I don’t know about you, but I have found that most BCM programs are mired in tactical problems—BIAs, recovery strategies, etc.—and never obtain a bird’s-eye view of their risk situation, such as you get by considering residual risk.)

In my opinion, you definitely should be making residual risk a cornerstone of your program. I truly think that residual risk is the shape of the future for business continuity management.

…

https://bcmmetrics.com/residual-risk-wrong/