Inherent Risk
The level of risk present in an activity or process before any controls or mitigation measures are applied.
Also known as: Gross risk, Raw risk
Category: Business & Economics
Tags: risk-management, governance, decision-making, compliance
Explanation
Inherent risk (also called gross risk) represents the natural level of risk in an activity, process, or environment when no controls, safeguards, or mitigation measures are in place. It reflects the raw exposure to potential losses or negative outcomes and serves as the starting point for risk assessment and management.
**Role in risk management**:
Inherent risk establishes the baseline against which the effectiveness of controls is measured. By comparing inherent risk to residual risk (the risk remaining after controls), organizations can quantify the value their risk management efforts provide. This comparison helps justify the cost of controls and identifies areas where additional investment may be needed.
**Factors that determine inherent risk**:
- **Complexity**: More complex processes have higher inherent risk
- **Volume**: Higher transaction volumes increase inherent risk
- **External environment**: Market volatility, regulatory changes, and competitive pressures
- **Human factors**: The degree of manual intervention and judgment required
- **Novelty**: New activities carry higher inherent risk than established ones
**Inherent risk in different domains**:
- **Financial auditing**: The susceptibility of financial statements to material misstatement before considering internal controls
- **Information security**: The threat landscape and vulnerability exposure before security controls
- **Project management**: The raw exposure to schedule, cost, and scope risks before mitigation planning
- **Compliance**: The likelihood of regulatory violations before compliance programs are implemented
**Best practices**:
- Assess inherent risk before designing controls to ensure proportionate responses
- Use inherent risk levels to prioritize where to invest in controls first
- Revisit inherent risk assessments when business conditions change
- Communicate inherent risk levels alongside residual risk to provide full context for decision-makers
Related Concepts
← Back to all concepts