Glossary
Inherent risk
Inherent risk is the level of risk that exists before any controls are applied, assessed from its likelihood and its potential impact.
Inherent risk explained
When a risk is first identified, it is scored as if nothing were being done about it. That is the inherent risk: how likely the event is and how bad it would be in the absence of controls. It is a starting point, not a prediction of what will happen.
Scoring inherent risk separately from residual risk shows how much the controls are actually doing. If a risk is rated high inherently and low residually, the institution is relying heavily on its controls and should test them carefully.
For example, the inherent risk of cash theft at a busy branch is high; the guards, dual custody and daily reconciliations are what bring it down to the residual level.
Why it matters in life insurance
Risk registers used by Zambian institutions commonly follow ISO 31000 or COSO and record both inherent and residual scores so that boards and regulators can see the effect of the control environment. ERMAML, the Ontech Risk & Compliance Suite, scores each risk on both bases and links the controls that account for the difference.
Related terms
Residual risk · RCSA (risk and control self-assessment) · Risk appetite