What is the definition of inherent risk?

• A. The level of risk that exists in the absence of any controls.
• B. The risk remaining after controls are applied.
• C. The risk introduced by new technologies.
• D. The risk associated with external threats only.

Answer: (A)

Inherent risk is the level of risk that exists before any security controls are applied. It represents the natural danger posed by the environment, threats, and vulnerabilities, and the potential impact if a breach occurs, assuming no safeguards are in place. This baseline helps you understand how much risk you would have to manage even before you start adding protections. The risk remaining after controls are applied is residual risk, not inherent risk. The risk from new technologies and the risk from external threats alone don’t capture the full baseline of danger present without controls, since inherent risk includes both internal weaknesses and external factors.