thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Governance, Risk, Audit & Privacy

Inherent Risk vs Residual Risk: What's the Difference?

Inherent risk is the level of risk that exists before any controls are applied. Residual risk is what remains after controls are implemented, and it must fall within the organization's risk appetite or be further treated.

Inherent Risk

Full definition
vs

Residual Risk

Full definition
Inherent RiskResidual Risk
Controls considered?NoYes
TimingBefore treatmentAfter treatment
Can it be zero?NoNo, some risk always remains
Management decisionPrioritize which risks to treatAccept, or treat further if above appetite
Formula ideaThreat x vulnerability x impactInherent risk minus control effectiveness
Remember it

Inherent is the raw risk; residual is what is left after you fight back.

Exam tip

Exams frequently ask who accepts residual risk: senior management or the risk owner, not the security team. Total risk minus controls gap equals residual risk in CISSP terms.

Tested on

More Governance, Risk, Audit & Privacy look-alikes