Inherent risk is defined as:

• A. Level of risk that exists with all of the necessary controls in place
• B. Amount of risk an organization can incur when there's an absence or failing of controls
• C. Risk after remediation
• D. Risk due to external events

Answer: (B)

Inherent risk is the level of risk that exists in a process due to its nature, before any controls are applied. It represents how much risk the organization could face if controls are absent or fail. The option that describes the amount of risk when controls are absent or ineffective matches this idea exactly. The other concepts describe risk after controls are in place (residual risk) or post-remediation, or risk from external events, which are not the same as inherent risk.