What Is Inherent Risk? How to Score and Use It in Risk Assessments

Every risk assessment involves two questions: how bad could this get without protection, and how bad is it with our current defenses? Inherent risk answers the first. It's the starting point for every risk assessment and the benchmark against which all controls are measured.

What Inherent Risk Means

Inherent risk is the level of exposure to a threat before any controls, mitigations, or safeguards are applied. It is always assessed alongside residual risk — the exposure that remains after controls are in place.

Think of it as the counterfactual: if your organization had no security policies, no access controls, no monitoring, no incident response — how likely is this risk to materialize, and how bad would the outcome be?

That's inherent risk. It's hypothetical by design. The goal is to establish the raw baseline.

Inherent Risk vs. Residual Risk

These two assessments form the core structure of any risk register:

Concept	Definition	Controls Considered?
Inherent Risk	Raw exposure before any controls	No
Residual Risk	Remaining exposure after controls are applied	Yes
Control Effectiveness	The gap between them	—

Example — Phishing Attack Risk:

Assessment	Likelihood	Impact	Score	Level
Inherent (no controls)	5 — Almost Certain	4 — Major	20	Critical
Controls applied	Email filtering, security training, MFA, conditional access
Residual (with controls)	3 — Possible	2 — Minor	6	Medium
Control effectiveness			70% reduction

The 14-point reduction from 20 to 6 is the measurable value of those four controls. Without inherent risk scoring, that value is invisible.

How to Score Inherent Risk

Inherent risk uses the same formula as residual risk, applied without controls:

Inherent Risk = Inherent Likelihood × Inherent Impact

Step 1: Score Inherent Likelihood

Ask: If we had no controls for this risk, how likely is it to occur?

Level	Label	Probability	Time-Based
1	Rare	< 5%	Not expected in 5 years
2	Unlikely	5–20%	Once in 2–5 years
3	Possible	20–50%	Once in 1–2 years
4	Likely	50–80%	At least once this year
5	Almost Certain	> 80%	Multiple times this year

Key discipline: Score based on the threat environment, not your current defenses. For phishing, the threat frequency is "almost certain" because phishing campaigns are continuous — that's the inherent likelihood regardless of your email filters.

Step 2: Score Inherent Impact

Ask: If this risk materialized with no controls to limit the damage, how severe would the consequences be?

Level	Label	Financial	Operational	Regulatory
1	Negligible	< $10K	< 1 hour disruption	No regulatory interest
2	Minor	$10K–$100K	Hours of disruption	Minor finding
3	Moderate	$100K–$500K	Days of disruption	Regulatory inquiry
4	Major	$500K–$2M	Weeks of disruption	Formal investigation
5	Catastrophic	> $2M	Months of disruption	License revocation

Key discipline: Score the worst realistic outcome, not the average. For a data breach, inherent impact should reflect full data exposure — before encryption, DLP, and access controls limit the blast radius.

Step 3: Calculate and Map to Risk Level

Score	Level	Meaning
1–5	Low	Minimal exposure; standard monitoring
6–12	Medium	Meaningful exposure; treatment plan required
15–20	High	Significant exposure; active mitigation required
21–25	Critical	Severe exposure; immediate action required

Why Inherent Risk Assessment Fails

Starting from the current state

The most common mistake: assessing "how likely is this risk?" while mentally factoring in existing controls. This collapses inherent and residual scoring into one muddled assessment. The result is artificially low inherent scores and no meaningful gap to measure control value.

Fix: Explicitly state "assuming no controls exist" before scoring. Some teams find it useful to physically remove the controls list from view while scoring inherent risk.

Anchoring to previous scores

If last year's inherent score was 16, assessors often land near 16 again regardless of whether the threat environment has changed. Inherent risk should reflect current threat intelligence, not historical scores.

Fix: Start each assessment period by reviewing threat data first — industry incidents, vulnerability disclosures, regulatory changes — before opening the risk register.

Treating inherent risk as theoretical and skipping it

Some organizations skip inherent scoring entirely and assess only residual risk. This produces a risk register that shows current state but can't answer "are our controls working?" or "where would we be most exposed if a control failed?"

Fix: Both scores are required. Inherent risk without residual risk is theoretical. Residual risk without inherent risk is unanchored.

Underscoring inherent impact to avoid executive attention

A Critical inherent risk score generates conversations. Some assessors unconsciously score inherent impact lower to avoid the scrutiny. This defeats the purpose of the assessment.

Fix: Separate the assessment from the response. The assessment should be honest. The response (controls, treatment decisions, risk acceptance) is where judgment about organizational context applies.

Inherent Risk in Practice

What a well-structured risk register looks like

Each risk should capture both scores:

Field	Example
Risk	Unauthorized access via compromised credentials
Inherent Likelihood	4 — Likely
Inherent Impact	5 — Catastrophic
Inherent Risk Score	20 — Critical
Controls	MFA, PAM, access reviews, SIEM alerting
Residual Likelihood	2 — Unlikely
Residual Impact	3 — Moderate
Residual Risk Score	6 — Medium
Control Effectiveness	70%

Plotting inherent vs. residual on a risk matrix

Showing both positions on a heat map — with an arrow between them — communicates control value at a glance. Risks where the arrow is long indicate highly effective controls. Risks with no arrow movement indicate controls that aren't reducing exposure.

Inherent risk for new risks (no controls yet)

When a new risk is identified with no controls in place, inherent risk and residual risk are the same score. The gap opens as controls are implemented. This makes inherent risk especially important for newly identified risks — it establishes the treatment baseline and justifies prioritization.

Key Principles

1. Always score inherent before residual — the sequence matters for bias prevention
2. Inherent risk reflects the threat, not your defenses — score based on the external environment
3. The gap is the point — if inherent and residual are similar, either controls aren't working or the inherent score was anchored to the controlled state
4. Inherent risk doesn't change unless the threat changes — your inherent phishing risk stays high regardless of how good your controls get
5. Never skip it — a risk register with only residual scores can't measure control effectiveness or scenario-plan for control failures