Residual & Target Risk Tracking

A single risk rating can show today’s exposure, but it cannot explain where the risk started, where the organisation intends to take it, or whether the response is working.

Nortrue separates inherent risk, current residual risk and target risk. Inherent risk provides the underlying baseline before controls, residual risk shows today’s exposure after considering controls that are in place, and target risk records the intended future position.

Each assessment can include its own rationale. Risk reviews preserve changes to likelihood, impact, score and rating so teams can see residual movement over time and compare current exposure with the target. Mitigation activity stays connected to the risk, while assessment changes remain an explicit decision by the risk owner rather than an automatic calculation.

Residual & Target Risk Tracking connects assessment judgement to Nortrue’s wider risk workflow.

Current residual ratings remain the primary view across risk registers, dashboards, alerts and reporting. Inherent and target assessments add the context needed to explain the underlying exposure and intended future position. Risk mitigations, owners, review dates and timeline events then help teams understand what is changing around the assessment without calculating the rating on their behalf.

This capability works naturally with Operational & Strategic Risk Registers, Risk Matrix Visualisation, Risk Actions & Mitigations, connected decisions, operating alerts and leadership review rhythms.