Abstract: A system and method for determining residual business risks by correlating threats, controls, business continuity factors, and other general risk considerations is described. Requirements of an initiative of a project are mapped to a taxonomy, and the mapped requirements are rated with respect to its importance to the project. Projected changes in the mapped requirements are forecasted over a specified period of time, such as an eighteen month period. A threat to the project is mapped to the taxonomy, and the mapped threat is rated with respect to its impact on the project. Projected changes in the effectiveness of the control are forecasted based upon historical data, a maturity rating, and the rated effectiveness of the control. Residual risk associated with the project is then determined, and adjustments to one or more resources associated with the project may be made to reduce the determined residual risk.