Which statement correctly distinguishes inherent risk from residual risk?

• A. Inherent risk is the risk after controls; residual risk is the risk before controls.
• B. Inherent risk is risk before controls; residual risk is risk after controls.
• C. Inherent risk is risk only in high-risk environments; residual risk is risk in low-risk environments.
• D. Residual risk includes control effectiveness; inherent risk ignores it.

Answer: (B)

Inherent risk is the natural level of risk present before applying any controls, while residual risk is what remains after controls have been put in place and their effectiveness is considered. This means the statement that inherent risk is risk before controls and residual risk is risk after controls is the correct one. Controls aim to reduce risk, but they rarely eliminate it entirely, so residual risk reflects the portion that persists after mitigation.

The other ideas don’t fit: reversing the order would imply controls come before assessing risk, which isn’t how the concepts are defined; tying inherent risk to environment alone ignores that risk is evaluated relative to controls; saying residual risk includes control effectiveness while inherent risk ignores it captures the key point that controls influence residual risk, whereas inherent risk is evaluated without those controls.