Plain definition
Inherent risk is the level of exposure in an activity before considering the controls that management has put in place. It reflects the nature of the activity and its environment: complexity, judgment, transaction volume, rapid change, incentives, external dependence, or susceptibility to error or fraud. It is a starting point for deciding where control effort may be needed.
Inherent risk is not a prediction that something will fail, and it is not the same as residual risk. A simple activity can have high inherent risk in unusual conditions, while a complex activity may be well managed after effective controls are considered.
Illustrative example
Suppose a company sells customised long-term projects that require estimates of completion, future costs, and potential contract penalties. Before discussing project reviews, finance identifies high inherent risk because the revenue and margin figures depend on judgment, changing engineering information, and customer acceptance. The controller asks for evidence behind estimates and flags projects with large changes in forecast cost.
The team has not yet concluded that reporting is unreliable. It has recognised that the activity deserves closer assessment and stronger evidence than a simple cash sale. Later control testing and project reviews determine what risk remains after the company’s response.
Assess inherent risk before giving credit for controls; otherwise a familiar process may look safer than its underlying uncertainty warrants.
Why it matters
It helps boards and management focus on activities where the nature of the business creates meaningful exposure before any safeguard is considered.
It prevents a control owner from describing a risk as low merely because a control exists, without testing whether that control works.
Practical consequence
For each material objective, identify the sources of exposure that would exist if the relevant controls stopped operating.
Use operational evidence such as estimates, transaction complexity, changes, and incentives to explain the judgment, then revisit it when circumstances change.