A workshop debates casual uses of inherent risk. What is the IRM meaning that should be locked for the exam?
Select an answer to reveal the explanation.
Short Explanation
Inherent risk is the raw weather before you put on a coat. Measure the exposure as if controls were not yet helping—then talk about what the controls change.
Full Explanation
Inherent risk is exposure before considering the effectiveness of controls—the raw weather before the coat goes on. Workshop debates that redefine inherent risk as residual risk after perfect compensating controls invert the sequence and break risk methodology used in civic IRM programs. IRM overview items expect the pre-control definition so later residual discussions have a defensible baseline and so leadership does not confuse “we have controls” with “exposure is gone.” Documenting inherent risk also forces honest conversation about which threats matter for a plant, clinic, or payment service before scoring control comfort. Equating inherent risk only to the count of open security incidents this week substitutes operational volume for structured exposure assessment. Equating inherent risk to software license underuse in SAM again pulls entitlement metrics into risk vocabulary incorrectly. Exam caveat: lock inherent as pre-control exposure; do not smuggle residual, incident counts, or SAM metrics into the definition on CIS-RC items. Operational check for the risk workshop: for one plant or application entity, record an inherent rating with controls notionally disregarded, document the rationale with threat and impact notes, then separately capture control effectiveness inputs before any residual rating is finalized.