A civic board packet shows two scores for the same cyber risk. What distinction must members keep as their mental model?
Select an answer to reveal the explanation.
Short Explanation
Inherent is the storm before you open the umbrella; residual is what still soaks you after the umbrella is up and working. Boards need both numbers—confusing them or treating them as twins loses the control story.
Full Explanation
Board members reading two scores for the same civic cyber risk must keep this mental model: inherent is exposure before considering controls; residual is remaining exposure after effective controls. Both numbers inform appetite conversations for public services. Believing inherent is always lower than residual because controls increase risk fails by concept because effective controls reduce—not increase—residual relative to inherent. Treating residual as a framework category name and inherent as an entity class fails by concept because those are taxonomy concepts, not assessment factors. Treating inherent and residual as interchangeable labels fails by concept because they answer different questions about pre- and post-control exposure. Exam caveat: CIS-RC distinguishes inherent versus residual as before-controls versus after-effective-controls exposure. Operational check: on a sample cyber risk, display inherent and residual side by side in the board pack with a one-line definition of each, and confirm residual is not lower than inherent when all related controls are ineffective. In civic IRM programs, retain configuration and decision evidence so examiners can reconstruct why this design supports public services.