Risk Assessment, Inherent and Residual Risk Scoring
Core concepts
Risk assessment converts qualitative judgment into a consistent rating using defined likelihood and impact scales. Candidates must understand scale design: number of levels (often 3–5), clearly defined anchors, defined impact dimensions (financial, customer, regulatory, reputational, operational), and the aggregation rule (usually the higher of likelihood or impact determines the rating on a matrix). Qualitative, semi-quantitative (numeric scales mapped to ranges), and quantitative approaches each have trade-offs; quantitative loss modeling is strongest where data exists.
Inherent risk is assessed assuming no controls, or sometimes with only the control environment considered - the definition must be documented and applied consistently. Residual risk is assessed after considering control effectiveness. Risk appetite and tolerance set thresholds for escalation and acceptance. Velocity (how fast a risk materializes) and persistence are increasingly used dimensions. Calibration sessions and benchmarking across units reduce scoring inconsistency.
Traps
Frequently tested: inconsistent inherent-risk definitions across units; double counting controls by reducing likelihood and impact both when only one is affected; treating a low residual score as proof controls work without testing; and using a matrix whose aggregation rule is undefined. Another trap is anchoring on prior scores or on the risk owner's optimism without challenge.
Worked example / rule of thumb
Rule of thumb: "Score inherent, then apply control effect once, then document why." Example: a manual wire process has high inherent likelihood of input error. A validated payment template with automated format checks reduces likelihood to low but does not change the impact of a misdirected wire, which remains high. The residual rating reflects the changed likelihood only. If a candidate answer reduces both dimensions without justification, it is likely wrong.