Most people don't recognise inherent risk exists. They see a residual risk number and think it measures control quality. It doesn't. A score of medium residual risk is not a measure of control quality. It is a measure of the assumption you made about control quality. Those are very different things.
The Two Types of Risks Every Board Must Understand
Inherent risk: is the “naked risk”, what you face before any controls. Raw exposure.
Residual risk: is what remains after controls are applied. But here's the catch: residual risk is only as good as the controls it's based on.
The Substraction Error
The most common mistake: treating inherent and residual risk like a mathematical equation. “Our inherent risk is a twelve. Our residual risk is a six. We have reduced it by half."
That sounds reasonable until you realise those two numbers were rated by different people using different assumptions. One imagined a world with no controls. The other assumed existing controls work perfectly.
Those aren't connected scores. They're two separate opinions.
The Fire Department Test
Ask your risk team: "How do you know your controls are any good?" The usual answer: *"Because nothing bad has happened." Here's the follow-up: "How do you know the risk hasn't happened if the control is not catching anything?"
A fire department with expired extinguishers and a last drill two years ago isn't proving effectiveness. It's proving luck. If your backup runs daily but has never been restored, your residual risk score isn't medium. It's whatever your inherent risk is because your control is on paper and untested.
Three Questions Every Board Should Ask
When reviewing any risk in the register:
1. When was this control last tested under real conditions?
2.What did the test results actually show?
3.If the control failed tomorrow, would we know?
Not "what does the score say." What does the control actually do?
The Bottom Line
The gap between inherent and residual risk is not a measure of how well you've done. It is a signal about whether your controls are working. A large gap with untested controls is not a win. It is a warning.
Well-managed high residual risk where controls are tested, ownership is clear, and readiness is real, beats paper-low residual risk where scores are made up.