The three-point risk assessment model distinguishes three related but distinct measures of an organization's risk exposure at different stages of the control lifecycle. **Inherent risk** is the raw, uncontrolled exposure that exists due to the nature of the business activity, the threat landscape, and the organization's information assets — before any controls, safeguards, or mitigation strategies are applied. **Residual risk** is the risk remaining after management has deliberately designed and implemented controls; it represents the planned or expected post-control state, assuming those controls function as designed. **Current risk** (also called existing risk) is the actual exposure at a specific point in time — reflecting the real state of the control environment today, including control degradation, new threats, staffing gaps, and configuration drift. Together, the three form a progression: Inherent Risk → [Controls Applied] → Residual Risk → [Reality Check] → Current Risk. CRISC professionals use this model to isolate control effectiveness (the inherent-to-residual gap), detect control failure (the residual-to-current gap), and prioritize remediation investments.
Where it stops · what it isn't
- —Inherent risk is NOT worst-case or catastrophic risk — it is the realistic baseline exposure absent controls, grounded in current threat likelihood and asset value, not theoretical maximums.
- —Residual risk is NOT inherent risk minus a fixed percentage — it is the risk remaining after defined controls are assumed to function correctly; it is a planned post-control state, not a calculated discount.
- —Current risk is NOT synonymous with residual risk — current risk accounts for real-world degradation, emerging threats, and control failures that may cause actual exposure to exceed residual expectations.
- —This model does NOT replace a full risk assessment methodology; it is a classification layer applied within a broader risk identification and analysis process.
- —These terms are CRISC-specific: 'net risk' (common in enterprise risk management) maps to residual risk; 'actual risk' or 'present risk' (used in some frameworks) maps to current risk — terminology alignment is required when working across frameworks.
- —Inherent risk assessment does NOT assume a threat-free or control-free future; it applies current threat landscape probabilities to unprotected assets.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFIT Risk Assessment (CRISC Domain 2)
REQUIRESRisk Scenario DevelopmentRisk Analysis Methodologies (Qualitative and Quantitative)
ENABLESRisk Treatment and Response OptionsControl Design and Effectiveness AssessmentRisk Appetite and Tolerance Calibration
RELATED TOVulnerability AnalysisThreat ModelingBusiness Impact Analysis
CONSTRAINSControl Investment Prioritization and Budget Decisions