Inherent risk

Inherent risk is the level of risk that exists in a process or system before any controls are implemented to mitigate it. It represents the natural susceptibility of an asset or activity to a threat based on its intrinsic characteristics. This baseline measurement allows practitioners to determine where the most significant vulnerabilities exist regardless of existing safeguards.

In practice

An auditor assesses inherent risk during the planning phase to decide which areas require more testing; for example, a database storing unencrypted healthcare records is flagged as high inherent risk due to the sensitivity of the data itself.