Sometimes you’ll hear insurance professionals, banking professionals, computer security professionals, and other people who deal with risk talk about inherent risk and its counterpart, residual risk. If these are unclear to you, or you just need a refresher, you came to the right place. Let’s take a look at a simple inherent risk definition and example, as well as residual risk.
Some people will expect you to memorize these. That said, I’ve been working in this space since 2011, and the only time I’ve ever used the phrases “inherent risk” and “residual risk” was in a job interview. I talk about inherent risk and residual risk almost every day, but most people don’t want to hear those words. They just want to know what they need to do and why.
Inherent risk definition
Inherent risk is the likelihood of something happening if you don’t try to do anything about it.
When I go to get a loan, bankers figure out the risk of me defaulting on it based on my credit history, my bank account balance, and things they find on my tax return. When I buy insurance on my car or house, insurance professionals figure out the chances of me making a claim, then they figure out how much they need to charge me in order to make a profit.
In my line of work, I scan a computer network and look for things a hacker might be able to take advantage of. My tools assign a numeric score to anything they find.
When it comes to insurance or a loan, sometimes the inherent risk is all they care about. I’ve had loan officers fall all over themselves to approve a loan. I’ve also had loan officers tell me to get lost. When they’re eager, they see me as low risk. When they tell me to get lost, it means they found something they don’t like, and they decided I’m too risky. It can happen.
That’s an inherent risk definition. There’s no reason to make it any more complicated than that.
Residual risk definition
The key to inherent risk is “if you don’t try to do anything about it.” Frequently you can do things to reduce risk.
For example, you are more likely to get injured or killed in a car accident than in a plane accident. If that scares you, you can look for a car with the best safety record. You can even go all out and put the best tires and best brakes on it. The car with the good safety record reduces the chances of something happening to you if it gets into an accident. It may also reduce the chances of an accident in the first place. The high-grade tires and brakes will also reduce the chances of an accident. I’m sure someone who works in the insurance industry would be able to tell you how much.
Sometimes when I ask for a loan, the loan officer comes back with some questions. One time I got turned down for a loan because they found a big charge on my bank account. It happened to be a trip to Las Vegas. I didn’t think anything of it because I went to Las Vegas on business and my then-employer reimbursed every cent of it. Now, when my usual bank sees something like that, they ask me what’s going on. I tell them, and then the mark that risk as mitigated.
Mitigations
One time, a bank put stipulations on a deal. I was buying a house that needed a paint job. They wanted the paint job done before closing. In their mind, this mitigated the risk of me defaulting and them having trouble selling the house because the paint looked bad.
Mitigations are things you do to reduce risk. Residual risk is what remains after you factor in the mitigations. After you’ve done everything you can do about it, residual risk is what’s left over.
Risk appetite
Everyone has a different risk appetite. There’s a joke about airplanes and black boxes. The black box in an airplane is nearly indestructible. So what is that stuff? And why isn’t the whole plane made of that stuff?
There may be several reasons, but in the end, it probably comes down to cost. Making planes of boring metals like aluminum gives the best balance of safety, durability, and cost in most cases, so that’s what they use.
We probably could make cars with nearly perfect safety records, but they would cost too much. A perfectly safe car doesn’t do much good if it costs a million dollars, because not enough people could afford it. So instead, we get whatever amount of safety a car maker can build into a car that sells for $25,000.
Risk appetite can change over time. Banks were willing to tolerate a great deal of risk in 2007. As it turned out, they were willing to tolerate too much risk. And perhaps they were underestimating the risk too.
If the residual risk is low enough, you accept the risk and go with it. If the residual risk isn’t low enough, you have few other options. You can say no. You can ask for more mitigations. Or you can transfer the risk, which usually means buying insurance. If the insurance company is satisfied with the mitigations in place, it may write you a policy to cover the event of a loss.
And that’s it as far as a residual risk definition and inherent risk definition goes. I hope this helps.
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.