What is the difference between inherent risk and residual risk?

• A. Inherent risk exists before controls; residual risk remains after applying controls.
• B. Inherent risk is after controls; residual risk is before controls.
• C. Inherent risk is a type of financial risk; residual risk is not.
• D. Inherent risk only applies to IT; residual to business.

Answer: (A)

The main idea is that risk is assessed in two stages: what exists before any safeguards, and what remains after safeguards are put in place. Inherent risk is the level of risk present in the environment before any controls or mitigations are applied. It comes from the nature of the business, the data handled, external threats, and existing processes.

After you implement controls—policies, procedures, security measures, monitoring—the risk level should drop. The remaining risk, the residual risk, is what you still face even with those controls in place. It’s usually not zero because no set of controls is perfect and new threats can emerge or controls may have gaps.

For example, handling valuable customer data creates an inherent risk of a data breach. Encryption, access controls, and monitoring reduce that risk, but residual risk remains—perhaps from a potential zero-day vulnerability or a misconfiguration that a control didn’t anticipate. Organizations compare residual risk to their risk tolerance to decide if further controls are needed.

Why the other ideas don’t fit: the difference is not that risk is after controls or that one type is financial while the other isn’t, or that these concepts only apply to IT. Inherent risk is before controls, residual risk is after controls, and it applies across business and IT contexts.