Inherent risk

Inherent risk is the level of risk that exists before any controls or mitigating actions are applied — the raw exposure of an event, measured by its likelihood and impact.

Assessing inherent risk first shows how much a risk would matter if nothing were done about it, which is why a risk register scores it before residual risk. The gap between the two reveals how much work your controls are actually doing.

Related terms

Going deeper: Inherent vs residual risk, with worked examples shows the scoring arithmetic in full.