Cyber Risk Management
Inherent Risk vs Residual Risk: What’s the Difference, and Why It Matters
Inherent risk shows what an activity is capable of with no controls in place. Residual risk shows current exposure with controls applied. Confusing the two, or reporting only one, is one of the most common ways risk reporting misleads decision-makers.