Walk into most board risk discussions and you will find a heat map dominated by inherent risk scores. But inherent risk — the raw exposure before any controls — is not what the board is living with. Residual risk is. Here is why the distinction matters and how to manage it properly.
Inherent risk
The level of risk in the absence of any controls, mitigating actions, or management responses. It is a theoretical baseline — useful for prioritisation, but not a reflection of current reality.
Score = Likelihood × Impact (raw)
Residual risk
The risk remaining after controls and mitigating actions are applied. This is what the organisation actually faces — what is reported to the board, compared against risk appetite, and used for treatment decisions.
Score = Inherent × (1 − control effectiveness)
Inherent risk scores are almost always higher and more alarming than residual risk scores — which makes them useful for getting attention but dangerous if used for decision-making. Three common mistakes:
Mistake 1: Presenting inherent risk to the board as “our risk position”
Consequence: The board thinks the organisation is more exposed than it actually is, leading to over-investment in controls or loss of confidence in the risk function.
Mistake 2: Tracking only inherent risk in the risk register
Consequence: You lose the ability to demonstrate the value of controls. If inherent scores never change, the board cannot see whether the money spent on controls is working.
Mistake 3: Setting risk appetite against inherent scores
Consequence: Risk appetite is meaningless if it is not compared to the risk the organisation is actually living with. Appetite should always be compared to residual risk.
The most practical method is to assess control effectiveness as a percentage reduction applied to the inherent score:
Example: A risk with inherent score 20 (Critical) and Strong controls (60% reduction) has a residual score of 8 (Medium). That is a very different story to present to the board.
Three reporting principles that make residual risk meaningful at board level:
RiskMatrix Pro calculates both inherent and residual risk scores automatically and lets you toggle the heatmap between views in a single click.
Get started free →