Residual risk

What is residual risk?

Prevention does not eliminate all risks: some hazards are inherent to the activity (working at heights, handling chemicals, driving) and can only be reduced. The hierarchy of controls in Article 15 of Law 31/1995 mandates avoiding risks, assessing unavoidable ones, combating them at their source, adapting the work to the individual, replacing hazardous elements, planning for prevention, prioritizing collective protection over individual protection, and training workers. Once this sequence has been followed, what remains is the residual risk. Accurately understanding this risk allows us to decide whether it is acceptable, what controls must be maintained, and what information exposed individuals need.

The distinction between initial (or inherent) risk, residual risk, and acceptable risk guides the assessment. Initial risk is the risk that would exist without measures; residual risk is the risk that remains after the planned measures are implemented; and acceptable risk is the benchmark against which it is compared. A good assessment document presents all three: the level of risk before the measures, the existing and planned measures, and the resulting level, with a conclusion as to whether or not further action is required.

In machine design, the UNE-EN ISO 12100 standard formalizes the process: the manufacturer reduces risk through inherently safe design, protection, and complementary measures, and communicates in the instruction manual the residual risks that the user must control through training, procedures, and protective equipment. Royal Decree 1215/1997 extends this logic to the employer who uses the equipment.

How it is estimated and managed

• Estimation. Application of the same valuation method (matrix, specific method) to the scenario with the implemented measures, considering their real reliability and not just their existence on paper.
• Comparison with acceptability. If the residual risk exceeds the acceptable criterion, additional measures are planned; if it does not exceed it, the controls that must be maintained and their verification are defined.
• Communication. Information to workers (Article 18 of Law 31/1995) must include the residual risks of the job and the measures that control them, including mandatory PPE.
• Maintenance of controls. The estimated residual risk is only valid while the measures are in place: inspections, maintenance, current training, supervision, and health monitoring.
• Re-evaluation. Changes in equipment, processes, organization or people, as well as incidents or failures of measures, require a re-estimation of the residual risk (Royal Decree 39/1997, article 6).
• Record. The assessment documents the initial risk, the measures, the residual risk, and the decision, with traceability of the revisions.

Residual risk and individual protection

• Last barrier. PPE is used for residual risk that could not be avoided or sufficiently reduced by collective measures (Royal Decree 773/1997), never as a first option.
• Actual effectiveness. The residual risk with PPE depends on its suitability, fit, continued use, and maintenance; an optimistic estimate on paper may mask a high actual risk.
• Training and information. People need to know what residual risk each PPE covers and the consequences of not using it.
• Verification. Preventive observations and usage controls to verify that the residual risk remains at the estimated level.

Organizational application: how to manage residual risk

1. Structure the risk assessment in three columns: initial risk, existing and planned measures, and residual risk, using the same valuation method.
2. Estimate the residual risk considering the actual reliability of the measures (condition, maintenance, use) and not just their existence.
3. Compare with the acceptability criteria and plan additional measures when it exceeds them, following the hierarchy of controls.
4. Include residual risk and its controls in the information and training for each position and in the work instructions.
5. Define a program for verifying critical controls (inspections, maintenance, PPE, current training) and record compliance.
6. Re-evaluate the residual risk in the event of changes, incidents, or failures of the measures, and update the assessment.
7. Review in the audit and management review that residual risks remain within acceptable limits.

Preventive management software allows you to record the initial and residual risk of each hazard, link each control to its periodic verification, and alert when a control expires or fails, so that the estimated residual risk corresponds to reality.

Limits and common mistakes

1. Estimate the residual risk with planned but not implemented measures, or with deteriorated controls.
2. Confusing residual risk with acceptable risk and omitting comparison with an explicit criterion.
3. Reducing residual risk on paper through PPE without verifying its actual use and suitability.
4. Do not communicate the residual risk to exposed individuals or include it in job training.
5. Failing to verify the controls that support the estimate, which means the real risk grows without the assessment reflecting it.
6. Do not reassess after incidents that show the residual risk was greater than estimated.

The estimation of residual risk is the responsibility of prevention technicians with the appropriate specialization; this sheet is for informational purposes only.

Regulatory and reference framework

• Law 31/1995, articles 15, 16 and 18. Principles of preventive action, assessment of risks that cannot be avoided and information to workers .
• Royal Decree 39/1997, articles 3 to 6. Risk assessment, measures and review.
• Royal Decree 1215/1997, of July 18. Use of work equipment: measures by the employer against the residual risks of the equipment.
• Royal Decree 773/1997, of May 30. Use of personal protective equipment against risks that could not be avoided or sufficiently limited by collective means.
• ISO 12100:2010 . Safety of machinery: General principles for design, risk assessment and reduction, including the concept of residual risk.

ISO 45001 incorporates risk assessment and control determination in section 6.1 and the hierarchy of controls in 8.1.2; ISO 31000 defines residual risk as that which remains after risk treatment.