Which concept describes the risk present before mitigations — the risk level before any mitigating actions?

• A. Residual Risk
• B. Exposure
• C. Inherent Risk
• D. Threat

Answer: (C)

Inherent risk is the level of risk that exists before any safeguards are put in place. It reflects the natural exposure of assets to threats, considering current vulnerabilities and the potential impact if those threats exploit them, without accounting for any controls. After you apply mitigations, you reduce this risk, but some remains as residual risk—the part that cannot be entirely eliminated. That’s why inherent risk is the best match for the risk level present before mitigations. The other terms describe different ideas: residual risk is what stays after controls are applied, exposure is a general notion of how exposed an asset is, and a threat is a potential cause of harm rather than a quantified risk level.