Inherent risk vs residual risk — how do you explain it to non-risk people?
Participer à la discussionAucune garantie sur le contenu du forum. Les informations, opinions et discussions partagées sur ce forum sont fournies par les membres de la communauté et l'équipe LexFlag et ne constituent pas des conseils professionnels. LexFlag n'approuve, ne vérifie ni ne garantit l'exactitude, l'exhaustivité ou la fiabilité du contenu publié.
Identité des utilisateurs et contenu généré par l'IA. Rien ne garantit que les utilisateurs utilisent leur vrai nom, représentent une organisation ou expriment leurs propres opinions. Les réponses et contributions peuvent être partiellement ou entièrement générées par l'intelligence artificielle.
Vérification indépendante requise. Vous devez vérifier de manière indépendante toute information obtenue sur ce forum avant de prendre toute décision. LexFlag, ses affiliés et les contributeurs déclinent toute responsabilité pour toute perte ou tout dommage résultant de la confiance accordée au contenu du forum.
Every time I present risk assessments to the business, people get confused by inherent risk vs residual risk. The concept seems simple to us but I've watched executives' eyes glaze over when I try to explain why the same risk appears twice in different columns.
The pushback I get most: "If inherent risk is the risk before controls, and we always have controls, why do we even measure it? Just tell me the actual risk."
They're not entirely wrong tbh. How do you make the distinction between inherent risk vs residual risk meaningful to people who don't live in risk frameworks all day? And do you even bother presenting inherent risk to the board or just show residual?
The analogy I use: inherent risk is how fast your car can go. Residual risk is how fast you're actually going, given the speed limits, brakes, and your driving habits. You need to know both — the first tells you how dangerous the road is, the second tells you how well you're managing it.
For the board, I present both but I frame inherent risk vs residual risk as a measure of control effectiveness. If inherent risk is high and residual risk is low, your controls are working well. If they're both high, you have a problem. If inherent risk is low, you might be over-investing in controls for that area.
That framing turns it from a confusing academic exercise into a useful management conversation: where are our controls adding the most value? Where are they inadequate? Where might we be over-controlling?
3 réponses
Nadia's analogy is great. Here's why inherent risk still matters even though "we always have controls":
Inherent risk justifies your control investment. If you stop measuring inherent risk, you lose the ability to explain why you have expensive controls in some areas and light controls in others. The inherent vs residual risk gap is literally the value your risk management program provides.
It drives resource allocation. Two processes might have the same residual risk, but if one has high inherent risk (meaning controls are doing a lot of heavy lifting) and the other has low inherent risk, you should worry more about the first one — because if those controls fail, the exposure is much greater.
For board presentations, we recommend showing a simple 2x2 or scatter plot with inherent risk on one axis and residual risk on the other. It immediately shows which risks are well-controlled and which need attention, without requiring the audience to understand the technical definitions.
One thing that helped at our shop: we stopped using the words "inherent" and "residual" in executive presentations entirely. We relabeled them "uncontrolled risk" and "current risk." Same concept, much more intuitive language. Nobody asks what "uncontrolled risk" means — it's self-explanatory.
Small change but it eliminated like 80% of the confusion. Sometimes risk management's biggest obstacle is its own jargon.
Connectez-vous pour répondre
Plus de discussions dans Gestion des risques d'entreprise
Key risk indicators examples — what KRIs are you actually tracking?
Is the three lines of defense model actually working for anyone?
Parcourir les autres catégories
Besoin d'aide ?
Notre équipe de soutien est là pour répondre à vos questions
Messagerie intégrée
Les utilisateurs inscrits peuvent contacter le soutien directement via la messagerie.
Se connecter S'inscrire