Inherent risk vs. residual risk
Inherent risk is the level of risk before controls are applied. Residual risk is what's left after them. Here's how they're measured and used.
Inherent risk is the level of risk before any controls are applied, based on the nature of the activity, system, or vendor. Residual risk is the level of risk left after controls and treatments are in place. The difference shows how much your controls are doing. Residual risk is compared with your risk appetite to decide whether more treatment is needed.
An example
A vendor that processes production customer data has high inherent risk. If it has strong encryption, access controls, and a clean SOC 2 Type II report, its residual risk may be moderate. If one of those controls fails, residual risk goes up even though inherent risk hasn't changed.
Using both
- Inherent risk decides how deeply to assess something, as in vendor tiering.
- Residual risk decides whether to accept, mitigate further, transfer, or avoid.
- Tracking both shows the value of controls to leadership.
What to look for
Start vendor tiering with inherent risk, then move to residual risk once evidence comes in. That's the order to look for.
Questions
What is risk appetite?
The amount and type of risk an organization is willing to accept to reach its goals. Residual risk is compared against it.
See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.