A civic board packet shows two scores for the same cyber risk. What distinction must members keep as their mental model?
Select an answer to reveal the explanation.
Short Explanation
Inherent is the storm before you open the umbrella; residual is what still soaks you after the umbrella is up and working. Boards need both numbers—confusing them or treating them as twins loses the control story.
Full Explanation
Inherent risk estimates exposure without credit for controls; residual risk estimates what remains after considering control design and effectiveness. Residual should not systematically exceed inherent due to controls, and the terms are not framework or entity labels. Clear inherent-versus-residual framing is foundational for board risk decisions.