Inherent risk
- Term
- Inherent risk
- Exam
- CISA & CISM
- Definition
The level of risk before considering the effect of controls.
- Explained
Inherent risk is the exposure that exists before any controls are considered. It is driven by the nature of the activity: high transaction values, complexity, change and susceptibility to fraud raise it. Inherent risk is the starting point of both audit planning and information security risk assessment.
- In practice
A payments system that moves large sums has high inherent risk before any controls are considered.
- Often confused with
- Residual risk
- Exam angle
Compare with residual risk, which is after controls.
- Related