Inherent vs residual risk.

The same risk seen at two moments

Inherent and residual risk are not two different risks. They are the same scenario measured at two points: before your controls do any work, and after they have done it. Inherent risk is the raw exposure, the level of likelihood and impact you would face if the relevant controls were absent or failed entirely. Residual risk is what is left once the controls are in place and operating as intended. Reading them side by side is the whole point, because the gap between the two is the visible value of your control environment. A large gap says the controls are pulling their weight; a thin gap says you are spending effort for little reduction and should ask why.

Treating these as a pair changes how you spend. If two scenarios share a similar residual level but one started from a far higher inherent level, the control set holding it down is doing heavy lifting and deserves protection in the budget. The scenario that barely moved from inherent to residual is the one to revisit: either the control is weak, the wrong control, or the risk was never as exposed as the rating claimed.

What auditors and standards expect

The gap between inherent and residual is where assurance lives, so it has to be justified rather than asserted. An auditor reads the register and asks three things of every residual figure: which controls reduced it, whether those controls are genuinely operating rather than documented, and who accepted what remains. That last point matters. Residual risk is accepted by a named owner with the authority to carry it, and that acceptance has to sit inside the organisation risk appetite. A residual level that exceeds appetite is not a finished entry; it is an open item that demands further treatment, transfer, or a deliberate, documented exception.

This logic is baked into the major frameworks. ISO 31000 frames risk management as an iterative loop where treatment changes the risk and the modified risk is then re-evaluated, which is exactly the move from inherent to residual. ISO/IEC 27005 applies the same thinking to information security risk and is explicit that residual risk must be assessed and formally accepted by management before a system goes live or stays in production. NIST guidance on risk assessment carries the identical distinction between the risk an organisation faces and the portion that remains after responses are applied. None of these standards treat residual as a number you calculate once and file.

Doing it well in practice

In a working register, every line should let a reader trace inherent rating, the controls applied, residual rating, and the named owner who accepted it. Keep the rating method consistent between inherent and residual so the two are genuinely comparable; if you score impact and likelihood differently at each stage, the gap means nothing. Re-rate residual whenever a control changes, degrades, or is found ineffective during testing, because residual risk is only as current as the controls behind it. A residual figure that was set two audits ago and never revisited is decoration, not assurance.

The judgement that earns its keep is connecting residual risk back to appetite and treatment. Once residual sits at or below appetite, acceptance is reasonable and the owner signs. Where it sits above, the honest entry records the gap and the plan to close it, rather than rounding the number down to make the page look tidy. That discipline is what turns a register from a compliance artefact into a tool the board can actually use to allocate attention.