City GRC adds human review and rate limits to a GenAI service desk. How should risk scores be compared?

City GRC adding human review and rate limits to a GenAI service desk needs a before-and-after comparison of risk, not slogan-level equivalence. Compare inherent AI risk before controls with residual risk after human review and rate limits is correct because inherent risk describes exposure without (or before) those measures, while residual risk describes what remains afterward. Municipal GRC uses that delta to judge whether controls moved risk within appetite and whether more treatment is required for resident-facing service-desk GenAI.

Treat inherent and residual risk as identical marketing slogans fails by concept: the terms describe different states in the risk lifecycle and collapsing them erases control effectiveness analysis. Raise residual risk automatically whenever a control is added fails by concept: effective controls should reduce residual exposure relative to inherent risk, not inflate it by formula. Ignore residual risk because controls always eliminate all AI harm fails by concept: controls reduce but rarely erase GenAI residual issues such as remaining hallucination or abuse paths.

Exam caveat: residual can stay material even after human review and rate limits if coverage is partial, reviewers are overloaded, or limits are bypassed. The exam tests correct comparison framing, not a claim that two specific controls always suffice.

Operational check: for the GenAI service desk, score inherent risk pre-control, implement human review and rate limits with defined coverage, re-score residual risk with the same impact/likelihood method, document the delta on the city risk register, and open further treatment if residual remains above the approved municipal appetite.