Which statement best describes inherent risk versus residual risk?

• A. Inherent risk exists before controls; residual risk exists after controls.
• B. Inherent risk exists before controls; residual risk remains after controls.
• C. Both inherent and residual risk are eliminated by controls.
• D. Inherent risk equals residual risk.

Answer: (B)

Inherent risk is the level of risk that exists before any controls are in place, while residual risk is the level of risk that remains after controls have been implemented. Controls reduce risk by lowering likelihood and/or impact, but they rarely erase it completely. The remaining risk can persist due to gaps in controls, imperfect implementation, human error, or evolving threats. For example, encryption and access controls lessen the chance of a data breach, yet residual risk remains from phishing, insider threats, or new vulnerabilities. That’s why the description that inherent risk exists before controls and residual risk remains after controls best captures the relationship.