Before documenting controls on the hospital EHR risk, what assessment step should the risk owner complete?
Select an answer to reveal the explanation.
Short Explanation
Inherent risk is the storm before the umbrella. Score how bad it looks without controls first — then talk about what the controls buy you.
Full Explanation
Before documenting controls on a hospital EHR risk, the risk owner should assess inherent likelihood and impact before considering existing or planned controls. Inherent assessment establishes the baseline storm picture for clinical systems that hold protected health information. Jumping directly to residual scoring and skipping any pre-control view fails by concept because residual without inherent hides how much risk the controls are actually reducing. Accepting the risk formally with no likelihood or impact values fails by concept because acceptance without scored exposure is an ungoverned shrug. Retiring the risk because an EHR always has controls somewhere fails by concept because assumed controls do not replace assessment. Exam caveat: CIS-RC sequences inherent assessment before control consideration and residual scoring. Operational check: on the EHR risk, complete inherent likelihood and impact first with controls ignored, save those values, then document controls and calculate residual, confirming inherent and residual both remain visible for committee review. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.