Inherent risk is the level of risk that exists before any controls are applied, while residual risk is the level that remains after controls are in place and working. The difference between the two numbers shows exactly how much your controls reduce exposure, which is why both belong on every risk assessment.
What inherent risk means
Inherent risk is the exposure that exists naturally in an activity, assuming no mitigating controls are credited. It answers a simple question: if nothing were in place to protect us, how bad could this get and how likely is it? Assessing inherent risk early gives a clean baseline, because it shows which risks are naturally severe and therefore deserve the strongest governance and controls, rather than flattering the picture with controls that may not actually work.
What residual risk means
Residual risk is what is left after the controls you actually rely on are applied. No set of controls is perfect, so some risk always remains; the goal is to push residual risk down to a level the organisation is willing to accept. Residual risk is reassessed whenever controls change, when new threats appear, or on a regular review cycle, because a control that was effective last year may have degraded since.
The role of controls between the two
Controls are the bridge between inherent and residual risk. A preventive control lowers the likelihood that an event occurs, while a detective or corrective control limits the impact once it does. The more effective the control, the larger the gap between the inherent and residual scores. This is why control effectiveness is rated on its own scale and then applied to the inherent score, rather than guessed at in a single step. Crucially, a control that exists on paper but is never tested should not be credited at all, because residual risk reflects controls that genuinely operate, not controls that are merely intended.
A worked example with a likelihood times impact matrix
Consider a financial firm worried about unauthorised access to its online banking platform. On a five by five matrix, likelihood and impact are each rated from one to five and multiplied to give a score out of twenty five. Without controls, the firm judges the likelihood of a successful intrusion as 4 and the impact as 5, giving an inherent risk of 20, firmly in the red zone. The firm then credits three controls: multi factor authentication, encryption, and fraud detection.
- Inherent risk: likelihood 4 times impact 5 equals a score of 20, rated high or red, before any controls are credited
- Controls applied: multi factor authentication and fraud detection cut the likelihood, while encryption limits the damage of a breach
- Residual likelihood: falls from 4 to 2 because intrusions are now far harder to carry out
- Residual impact: falls from 5 to 3 because stolen data is encrypted and fraud is caught quickly
- Residual risk: likelihood 2 times impact 3 equals a score of 6, rated medium, the figure that goes on the register
The before and after snapshot, 20 down to 6, is exactly what senior management wants to see, because it quantifies the value of the control investment. A common formula expresses the same idea as residual risk equals inherent risk multiplied by one minus control effectiveness, so stronger controls produce a lower residual figure. Residual risk should always be lower than or equal to inherent risk; if a residual score ever exceeds its inherent score, the assessment contains an error.
NIST SP 800-30 uses a five level scale from Very Low to Very High for likelihood, impact, and overall risk, and treats risk determination as iterative: it first estimates inherent risk with no controls, then residual risk once controls are credited, and rechecks that residual risk stays within tolerance as threats evolve.
Why residual risk must be compared to risk appetite
A residual score means nothing in isolation; it has to be measured against risk appetite, the amount of risk the organisation has formally decided it is willing to accept. If residual risk sits within appetite, the risk can be accepted and monitored. If it sits above appetite, the firm must add or strengthen controls, transfer the risk through insurance, or avoid the activity altogether. This comparison is what turns a scoring exercise into a decision.
Residual risk versus target risk
Residual risk and target risk are often confused. Residual risk is where you are now, given the controls that genuinely operate today. Target risk is where you want to be, the level you are aiming for once planned improvements are complete. The gap between them is the remediation roadmap: each action plan is meant to move residual risk down towards the target, and tracking that movement over time shows whether the programme is working.
Common mistakes when scoring residual risk
Several recurring mistakes distort residual scoring. The first is double counting controls, crediting the same control against many risks so residual figures look artificially low. The second is crediting controls that are designed but not actually operating, which inflates the gap between inherent and residual risk on paper while real exposure stays high. A third is collapsing inherent and residual into one judgement, skipping the baseline entirely, which hides how dependent the organisation is on a handful of controls. Each of these errors makes the register look healthier than reality, and each is exactly what an internal auditor or regulator will probe.
A practical safeguard is to require evidence for any large reduction between inherent and residual scores. If a risk drops from 20 to 4, the assessment should name the controls responsible, state how their effectiveness was tested, and show the testing date. Where evidence is thin, the residual score should stay closer to inherent until the control is proven, a discipline that keeps the whole register defensible.
Inherent and residual risk in audit and cybersecurity
The same pair of concepts appears across disciplines under slightly different language. In financial audit, inherent risk is one input to the audit risk model, sitting alongside control risk and detection risk to decide how much testing is needed. In cybersecurity and third party risk, residual risk drives decisions about whether to onboard a vendor or accept a finding, and frameworks such as ISO 27005 and the NIST risk management approach expect both an inherent and a residual view before sign off. Wherever it appears, the underlying logic is identical: establish the baseline, credit the controls honestly, and judge what is left against an explicit appetite.
How inherent and residual risk appear in NIST 800-30 and ISO 31000
Both numbers are mandatory under the major frameworks. ISO 31000 encourages assessing inherent risk to understand baseline exposure and residual risk to confirm controls are sufficient, while NIST 800-30 and ISO 27005 carry the same logic into information security assessments, and COSO ERM ties it back to enterprise objectives. In practice this means every register row should show an inherent score, the controls, a residual score, and a clear comparison to appetite. For the assessment process that produces these numbers in operational risk, see our guide on the risk and control self-assessment.