Inherent and Residual Risk

Before and after controls

• Inherent risk is the level of risk before considering controls.
• Residual risk is what remains after them. It’s never zero, and must be within appetite or formally accepted.

Why both matter

• Inherent risk shows the exposure if controls fail, and identifies the key controls that must be tested.
• Residual risk shows the risk actually carried, and is compared with appetite to make decisions.

Estimating residual risk honestly

• Base it on how controls actually operate, using test results.
• Discount controls that are untested or have failed.
• Consider how controls could be bypassed.
• Re-estimate after control changes or failures.

Example. A team rated residual fraud risk low because a dual-approval control existed. Testing found approvers routinely approved their own requests through delegated accounts. Residual risk was re-rated high, close to inherent.

How the exam asks about it

In short

• Inherent risk is the level of risk before considering controls; residual risk is what remains after them.
• Residual risk should reflect controls as they actually operate, not as designed on paper.
• Comparing inherent and residual risk shows how much controls reduce risk, and which controls matter most.
• Residual risk is never zero; it must be within appetite or formally accepted.
• If key controls fail, risk returns towards its inherent level.

Exam traps

• Estimating residual risk assuming every control works perfectly.
• Believing residual risk can be eliminated.
• Closing a risk because controls exist, without checking residual risk against appetite.
• Ignoring inherent risk, which shows the exposure if controls fail.

Slides

Click the slide and use the arrow keys. F toggles full screen.