Inherent Risk

Inherent risk is the level of risk that exists before any controls or mitigating measures are applied. It represents the raw exposure an organization faces from a particular activity, process, or relationship, assuming no controls are in place to reduce the likelihood or impact of the risk.

Inherent risk is calculated by assessing the impact and likelihood of a risk event without considering controls. It provides a baseline understanding of exposure that helps organizations prioritize where to apply controls. The gap between inherent risk and residual risk (risk after controls) demonstrates the value of the control environment. If inherent risk is low, minimal controls may be needed; if inherent risk is high, a robust control framework is essential.