Inherent Risk and Residual Risk

Inherent Risk

Inherent risk is considered the risk before implementing a control. It is the risk that a process would pose if no control factors were in place (the gross risk, or, the risk before controls). It is the weakness or the susceptibility of a process to introduce a material error when there are no internal controls.

Inherent risk depends on the number of users and business areas. The higher the number of users and business processes, the higher the level of inherent risk will be.

Residual Risk

This is the risk that remains after controls have been considered (the net risk or the risk after controls).

Residual Risk = Inherent Risk - Controls

For a successful risk management program, residual risk should always be within the risk appetite. When the residual risk is within the risk appetite, it is considered an acceptable risk level.

The primary objective of a risk management program is to ensure that the residual risk is...