Inherent risk
Also called gross risk, raw risk
Inherent risk is the level of risk an activity, product, customer group or business carries before any controls or mitigating measures are taken into account. It shows how exposed a firm would be if nothing were done to manage the risk, and it is the starting point for every risk assessment.
How it works
Firms assess inherent risk by looking at the activity itself: what could go wrong, how likely it is and how much damage it would cause. In financial crime work the factors are customers, countries, products, transactions and delivery channels. In operational risk they include process complexity, volumes, technology and people. Each risk gets a likelihood and impact score, usually on a three, four or five point scale, which together give an inherent risk rating.
The inherent rating is then compared with the strength of the controls in place to arrive at residual risk. Keeping the two separate matters: a high inherent risk with strong controls can still be acceptable, while a rising inherent score warns that controls may soon be stretched. Supervisors expect firms to document how they reach inherent ratings and to refresh them when the business, customer base or threat picture changes.
The rules
Expects banks to set controls that mitigate inherent operational risks and to use risk and control self-assessments that evaluate inherent risk before controls are considered.
Banks under Basel Committee standardsDefines inherent risk as the level of money laundering and terrorist financing risk present before mitigating measures are applied, and requires supervisors to assess it for each firm and sector.
EU AML/CFT supervisors, in how they assess obliged entitiesCommon questions
What is the difference between inherent and residual risk?
Inherent risk is the exposure before controls. Residual risk is what remains after controls are applied. The gap between the two shows how much work the controls are doing.
Is inherent risk required by law?
No law requires the term itself. Basel principles, EBA guidelines and supervisors' expectations for risk assessments use it, and firms apply it as standard practice in business-wide and operational risk assessments.
How often should inherent risk be reassessed?
At least once a year in most firms, and whenever the business changes materially, for example a new product, a new market, an acquisition or a shift in the threat picture.
