Which term describes the risk level before management actions such as controls are applied?

• A. Current risk
• B. Inherent risk
• C. Residual risk
• D. IT-related incident

Answer: (B)

Inherent risk is the level of risk that exists before any controls are applied. It represents the baseline risk present due to the environment, processes, and inherent vulnerabilities, assuming no safeguards are in place. Think of it as the potential for adverse impact if threats exploit weaknesses without any mitigation. After controls are added, the remaining risk is called residual risk, not inherent risk. For example, a system with weak encryption has high inherent risk, but adding strong encryption reduces the residual risk while not eliminating it entirely.