How could we reduce residual risk

In line with Peter’s input - despite implementing a response to a triggered event, the risk still exists and will continue to be monitored. It is also evident that the response action may not be adequate to address the estimated cost and schedule impact of the risk event.

Whether threat or opportunity, the objective of the response is to minimize the impact of the threat or to maximize the benefit of the opportunity. As a result, the risk response may need to be re-evaluated and adjusted to assure the next time the event is triggered the response is more complete.

Kiron is correct. The cost of increasing a system's availability from 99.9% to 99.99% is enormous. Likewise, the smaller the residual risk, the more expensive it gets to manage it.

Sergio is also correct: your secondary risks can quickly grow larger than your residual risk.

Brother Masdur Rahman, residual risk is risk which remain after risk response planning. it should be document in risk register and kept on watch

Sometimes residual risks remains even after all possible risk responses are applied and that is usually accepted by the organization.