Risk Management
Inherent vs Residual Risk
Compares inherent and residual scores by risk category to show the value controls are adding.
Why the control-value comparison matters
King IV and the COSO framework both treat the risk management process as a chain from inherent exposure through controls to residual risk, and auditors are expected to evidence that the institution understands how much its control environment actually reduces risk. Comparing inherent against residual scores by category exposes where controls are doing real work and where high residual risk signals weak or absent mitigation. AuditPro Core plots both scores side by side so management can defend control investment and the audit committee can challenge categories where the gap is suspiciously small.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Avg inherent
16.2
Avg residual
9.4
▼ 42% reduction
Control uplift
6.8 pts
Weak-control categories
3
<25% reduction
Inherent vs residual by category
Reduction by category
| Category | Inherent | Residual | Reduction % |
|---|---|---|---|
| Financial | 18 | 9 | 50 |
| Operational | 16 | 11 | 31 |
| Compliance | 15 | 7 | 53 |
| Strategic | 17 | 12 | 29 |
| Technology | 19 | 10 | 47 |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
Inherent risk
Inherent risk is the exposure that exists before any controls are considered, driven by the nature of the activity itself. It sets the ceiling against which control effectiveness is measured.
Control value added
The reduction from inherent to residual score is the measurable value the control environment delivers. A large gap indicates effective controls; a small gap suggests controls are weak, absent or poorly designed.
Category-level analysis
Aggregating by risk category reveals systemic patterns that individual risks hide. A category where controls barely move the needle points to a structural control gap worth investigating.
False comfort risk
An unexpectedly low residual score on an inherently high risk can signal optimistic self-assessment rather than genuine mitigation. These gaps deserve corroboration through control testing.
How AuditPro Core Bridges the Gap
- Paired scoring: inherent and residual assessments are captured against the same risk so the reduction is computed automatically, not estimated.
- Gap exception flags: categories where residual sits implausibly close to inherent are surfaced for control-design review.
- Traceability to controls: each residual score links to the specific controls credited with the reduction, exposing unsupported claims.
- Continuous monitoring: as controls are tested and rated, residual scores update, keeping the comparison current rather than annual.
Key Takeaways
- The inherent-to-residual gap is the quantified value of your control environment.
- Small gaps on high inherent risks signal weak or unsupported mitigation.
- Corroborate low residual scores with control testing to avoid false comfort.
- Category roll-ups expose structural control gaps single risks conceal.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.