Inherent Risk

Overview

Inherent risk estimates the likelihood and impact of a risk scenario assuming relevant mitigating controls are absent or ineffective. It helps organizations understand the underlying nature of products, customers, technologies, geographies, processes, and dependencies.

The concept supports prioritization and comparison, but assumptions must be explicit because an entirely control-free scenario may be unrealistic. Built-in product characteristics can be difficult to separate from controls, and scoring methods vary between organizations.

Teams should define scenarios, scales, time horizons, and boundaries consistently, then document which protections are excluded. Comparing inherent risk with control effectiveness and residual risk helps identify where exposure is naturally high or overly dependent on one safeguard.

Inherent risk is the level of exposure associated with an activity before considering the effect of controls intended to reduce that risk. Inherent risk reveals underlying exposure before mitigation, helping distinguish a safer activity from one made acceptable only by strong controls.

For Inherent Risk, the assessment should evaluate the level of exposure associated with an activity before considering the effect of controls intended to reduce that risk. The assessment record should separate observed evidence supporting the level of exposure associated with an activity before considering the effect of controls intended to reduce that risk from assumptions, state the time horizon and existing controls, and identify who owns any remaining exposure. Monitoring should test whether the conditions described in the level of exposure associated with an activity before considering the effect of controls intended to reduce that risk have changed enough to require a new rating, treatment, or approval.

Decision-makers should use findings about the level of exposure associated with an activity before considering the effect of controls intended to reduce that risk to select treatment, assign remediation, set review thresholds, and document why any residual exposure is accepted.