Inherent risk is the level of risk before any controls are taken into account; residual risk is what is left after they are applied. The gap between the two shows how much work your controls are doing, and residual risk is the figure you compare with your risk appetite to decide whether what you have is enough or you need more.
Both are calculated the same way, likelihood times impact. What changes is the question you ask when you score: for inherent risk, what could happen if there were no controls at all; for residual risk, what can happen with the controls that exist today and actually work.
A worked example
Take a risk that shows up in almost every financial risk register: payment to an unauthorised third party because someone impersonates a supplier and asks to change their bank account. We use a 1 to 5 scale for likelihood and impact, so the risk level runs from 1 to 25.
Inherent risk. With no controls, any email asking for a change of account would be processed. These attempts reach accounts payable teams often, so likelihood is 4. Impact is high too, because a diverted payment is rarely recovered and can be the full amount of a large invoice: 5. Inherent level: 4 × 5 = 20.
Controls. The company has two. First, any change to bank details is confirmed by calling the supplier on the phone number already held in the vendor master file, never the one in the email. Second, a second person approves the change before the first payment goes out to the new account.
Residual risk. Both controls are preventive, so they act on likelihood: for the fraud to get through, both have to fail. If we know they are applied (there is a record of the calls and the approvals), likelihood drops to 2. Impact does not change: if the fraud does slip through, the money is lost all the same. Residual level: 2 × 5 = 10.
This is the detail people miss most often. A preventive control lowers likelihood; lowering impact takes something else, such as fraud insurance, an agreement with the bank to hold suspicious transfers or a cap on payments to new accounts. If every control in your matrix lowers both axes at once, check how they are being scored.
Two common ways to calculate residual risk
In practice two methods coexist, and both are valid if they are applied consistently.
- Re-scoring likelihood and impact. This is what we did in the example: the risk owner scores each axis again, taking into account which control acts on it. It is slower, but it forces you to explain why each number goes down.
- Applying a percentage based on control effectiveness. You rate how effective the controls are (say, 60%) and reduce the inherent level by that proportion: 20 × (1 − 0.60) = 8. It is quicker and gives results that can be compared across areas, but it depends entirely on effectiveness being measured properly.
In our view, the percentage works when effectiveness comes from documented control testing. When it comes from the opinion of whoever designed the control, it gives a precision that is not there: an 8 looks more exact than a 10, and it is not. If you are just starting out, re-scoring both axes is more honest and easier to defend in front of an auditor.
| Inherent risk | Residual risk | |
|---|---|---|
| What it measures | Exposure without controls | Exposure with the controls that exist and work |
| What it is for | Prioritising where controls are needed and where they are not | Deciding whether the risk is acceptable or needs further treatment |
| What it is compared with | Residual risk, to see how much the controls contribute | Risk appetite and risk tolerance |
| When it changes | When the business, the process or the threat changes | Also when a control is added, fails or stops being applied |
| Name in MAGERIT (Spain) | Potential risk | Residual risk |
Mistakes that distort the comparison
- Scoring inherent risk with the controls in place. This is the most common one. If, when scoring inherent risk, someone thinks “well, we already check this”, the inherent score comes out low, the gap with residual risk disappears and the controls seem to add nothing. It helps to write on the risk record itself: “score as if no controls existed”.
- Counting controls nobody has tested. A control written into a policy does not reduce risk until there is evidence that it is applied. If the last test failed, residual risk should go back up.
- Adding up controls that do the same thing. Two reviews of the same data by the same person do not halve the risk. For two controls to stack, they have to be independent.
- Zero residual risk. No control eliminates a risk. If residual risk comes out at zero, either the risk was badly described or it has been avoided altogether (for example, by stopping the activity), in which case it should be retired rather than scored again.
- Inflating inherent risk to make the reduction look good. It is tempting in committee reports: an inherent score of 25 across the board makes any control look like a big step forward. What the committee needs is a reasonable inherent score and a credible residual one.
What to do with residual risk
Residual risk is compared with the risk appetite approved by senior management. If it is within appetite, it is accepted and monitored. If it is outside, it has to be treated: reduced with more controls, shared (insurance, a contract) or avoided by stopping the activity. And if the organisation decides to accept a residual risk outside its appetite, that decision has to be signed off by someone with the authority to make it.
In information security this is an explicit requirement. ISO/IEC 27001:2022, in clause 6.1.3, requires risk owners to approve the risk treatment plan and accept the residual risks. In a certification audit you will be asked for evidence of that acceptance. To see how this fits with the risk assessment methodology, read about the relationship between ISO 27005 and ISO 27001.
In Spain, organisations working under the National Security Framework (Esquema Nacional de Seguridad, ENS) usually rely on MAGERIT, the risk analysis methodology of the Spanish public administration. MAGERIT does not talk about inherent risk: it uses potential risk for the risk calculated on assets and threats without safeguards, and residual risk for what remains once they are applied. It is the same idea under another name, so if you inherit an analysis done with MAGERIT there is no need to redo it to talk about inherent and residual risk.
When a 1 to 5 scale falls short
A 5 × 5 matrix is good for ranking risks, but it does not tell you how much money is at stake. Two risks at level 10 can be orders of magnitude apart. For the highest-rated risks, quantifying inherent and residual risk in euros or dollars lets you compare the cost of a control with the loss it prevents. We cover this in more detail in risk quantification: what it is and how to apply it.
In the GlobalSuite® Risk Management module, every risk has its inherent and residual rating with its heat map, and every control has its owner, its status and the result of its last test. When a test fails, you can see which risks rely on that control. If you want to see it with your own risks, request a demo.
Sources: ISO/IEC 27001:2022 page on iso.org and MAGERIT v3 on the Spanish Electronic Administration Portal. The example is illustrative and does not correspond to any client. Content reviewed in October 2026.
