Risk level before any controls or risk treatment measures are applied.
Inherent risk is the risk level that would exist if no controls were in place—the raw exposure before treatment. Assessing inherent risk helps understand the value of existing controls and prioritise where controls are most needed. The difference between inherent and residual risk demonstrates control effectiveness. Some frameworks assess inherent risk first, then evaluate how controls reduce it to residual levels.
Why It Matters
The DSC Perspective:
Inherent risk assessment shows where your greatest exposures are and demonstrates the value of your controls. It helps justify security investments by showing the risk reduction achieved.