Which risk level is the exposure without considering management actions such as controls?

• A. Inherent risk
• B. Residual risk
• C. Current risk
• D. IT-related incident

Answer: (A)

Inherent risk is the exposure that exists before any controls or management actions are applied. It represents how severe the threat and vulnerability combination could be if no safeguards are in place, essentially the maximum risk inherent to the asset or process. The question asks for the risk level without considering controls, which matches this definition exactly.

Residual risk is the remaining risk after you implement controls. Current risk typically refers to the risk level with the present controls in place. An IT-related incident is not a risk level—it’s a possible event. So the best answer is inherent risk.