Inherent vs residual vs target risk, with worked examples

Every serious risk register scores a risk more than once. Here is what inherent, residual and target risk each mean, how to score them on a 5×5 matrix, and why most residual scores are more optimistic than they should be.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 9 min read

Three scores, three questions

Each score answers a different question, so each is used for a different decision:

You may also see gross and net risk (used mostly in financial services and insurance) — they mean inherent and residual. Some organisations call target risk planned or future risk.

What is inherent risk?

Inherent risk is the exposure that comes with the activity itself: holding customer data, moving money, running a warehouse, depending on one supplier. It exists simply because you do the thing.

The usual instruction is to score inherent risk “as if there were no controls”. Taken literally, that produces absurd results — a world with no locks, no backups and no accountants. A more useful working definition is:

Read this way, inherent risk tells you something practical: which risks rely heavily on controls. A risk that is critical inherently but low residually is not “solved” — it is control-dependent. Those are the controls that deserve testing, audit attention and a named owner.

How to score inherent risk

• Describe a specific scenario, not the worst imaginable one (“payment fraud of up to £80k via a spoofed supplier email”, not “all money stolen”).
• Ask: if our controls against this did not work this year, how likely is the scenario and how bad would it be?
• Use the same likelihood and impact scales as for residual risk — see our 5×5 risk matrix guide for example anchors.
• Factor in the external environment: industry incident rates, current threat levels, regulatory attention.

What is residual risk?

Residual risk is what is left after the controls that actually operate are taken into account. Not the controls in the policy manual, not the ones planned for next quarter — the ones that work today, at the effectiveness you can evidence.

Residual risk is the most important of the three numbers. It is what goes on the heat map, what gets compared with risk appetite and what the board should see. Zero residual risk is not a realistic goal: some risk remains in every activity, and the aim is to bring it within what the organisation has chosen to accept.

The residual risk formula — and why it is an approximation

You will often see residual risk written as:

With an inherent score of 20 and controls rated 60% effective, the second version gives 20 × 0.4 = 8. It is a helpful way to think, but treat it as shorthand rather than a calculation, for three reasons:

1. Controls act on one dimension at a time. Preventive controls (access rights, approvals, training) mostly reduce likelihood. Detective and corrective controls (monitoring, backups, insurance, continuity plans) mostly reduce impact. Multiplying a single score by a single percentage hides which one moved.
2. Matrix scores are ordinal. A 12 is not exactly “twice as risky” as a 6, so subtracting or multiplying them is arithmetic on labels.
3. Control effectiveness is rarely known to the nearest 10%. A precise-looking 63% suggests accuracy that does not exist.

The more reliable method is simple: re-score likelihood and impact separately with the controls in place, and write one sentence on which control moved which dimension and why.

Rating control effectiveness

Whatever method you use, rate controls on evidence. A four-level scale is enough for most organisations:

What is target risk?

Target risk is the level you aim for once planned treatment actions are complete. It turns a register from a list of worries into a plan: every risk outside appetite should have a target inside appetite, actions to get there, an owner and a date.

Two tests keep target scores honest:

• Is it within appetite? If the target is still above what the organisation accepts, either the plan is not enough or the risk needs to be formally accepted by someone with authority to do so.
• Is it achievable with the planned actions? A target of 4 with a single action “update the policy” is a wish, not a plan.

When the actions are complete and the new controls are proven to work, the residual score moves to the target, and the target can be reviewed.

Worked examples on a 5×5 matrix

Scores are likelihood × impact, each from 1 to 5. Bands: 1–4 low 5–9 moderate 10–14 significant 15–25 critical.

What the examples show:

• Fraud: the approval control only moves likelihood by one level because it is partly effective. The planned call-back control targets likelihood, and payment limits cap the impact.
• Ransomware: endpoint protection lowers likelihood, but impact stays at 5 because the backups are untested. A control that has never been tested should not be credited with reducing impact. The planned actions reduce impact, not likelihood — the attack is no less likely, but recovery would take hours, not weeks.
• Customer concentration: good relationship management lowers likelihood, but nothing reduces the impact today. Only diversification does that, which is why the target needs a strategic action rather than a control.
• Key person: inherent equals residual — a clear signal that there are no controls, not that the risk is acceptable.

Common mistakes

1. Scoring inherent risk as the worst imaginable outcome

If every inherent score is 25, the column tells you nothing. Score a specific, realistic scenario with controls failed — and keep the same scenario for the residual and target scores, so the three numbers are comparable.

2. Residual lower than the controls justify

The most common problem in practice. Residual scores drop by two or three levels on the strength of a policy, a training course or a control that nobody has tested. Rules that help:

• A control only counts if it is operating today and someone owns it.
• Untested controls get partial credit at most.
• Each dimension moves only when a specific control targets it — write down which.
• If incidents have happened despite the control in the past year, the control is not effective.

3. Ignoring control failures

A low residual score for a control-dependent risk means you are betting on that control. Track it: test it, monitor its key indicators, and re-score immediately when it fails. A failed backup test should change the residual score of the ransomware risk the same day, not at the next annual review.

4. Counting planned actions as controls

“Implementing MFA in Q2” is an action, not a control. It belongs in the target score until it is live.

5. Skipping inherent risk altogether

Some teams score residual risk only, to save time. That is acceptable for a first register, but you lose the view of which controls matter most. Add inherent scores for at least your top 10–15 risks.

6. Residual higher than inherent

Controls cannot make a risk worse than having none. If this happens, the inherent score was set too low — or a control has created a new risk (a new outsourced provider, for example) that should be recorded as a separate entry.

How the three scores relate to risk appetite

Risk appetite sets how much risk the organisation is willing to accept in pursuit of its objectives; tolerance sets how far it can drift from that before action is mandatory. Comparing each residual score with both gives three states:

Inherent risk is not compared with appetite — nobody runs a business without controls. But a large gap between inherent and residual tells you how much of your position within appetite depends on controls continuing to work.