Which statement best describes inherent risk in risk assessment?

• A. It is the risk level after controls are applied.
• B. It is the risk present before applying controls.
• C. It is only risk from internal processes.
• D. It represents the risk that cannot be mitigated.

Answer: (B)

Inherent risk is the baseline exposure that exists before any controls or mitigations are put in place. It reflects the natural likelihood and impact of adverse events given the organization’s activities, environment, and complexity, independent of what controls you later implement. That’s why the description that it is the risk present before applying controls is the best fit.

Understanding this helps distinguish it from residual risk, which is the remaining risk after controls are applied, and from ideas that the risk arises only from internal processes or cannot be mitigated. In practice, even though inherent risk can be reduced with controls, it is not eliminated completely.