---
title: "Inherent risk"
description: "The likelihood and severity rating of a risk scenario before any control is counted."
canonical: https://aigovernanceengineer.com/glossary/inherent-risk
author: "Jorge García Aibar"
license: "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)"
doi: https://doi.org/10.5281/zenodo.22956197
version: "0.5.0"
updated: 2026-09-24
---

# Inherent risk

The likelihood and severity rating of a risk scenario before any control is counted. The gap between inherent and residual risk is the value claimed for the controls, and must be backed by their evidence [1].

- Developed in: [ch. 13, Inherent risk, residual risk and who accepts it](https://aigovernanceengineer.com/bok/risk-management#inherent-risk-residual-risk-and-who-accepts-it)
- Chapters: [ch. 13, Risk Management](https://aigovernanceengineer.com/bok/risk-management)
- Contrast with: [Residual risk](https://aigovernanceengineer.com/glossary/residual-risk)
- In the glossary chapter: https://aigovernanceengineer.com/bok/glossary#t-inherent-risk

## Sources

[1] Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (risk tolerance and residual risk; seven trustworthy characteristics; transparency answers "what happened", explainability "how", interpretability "why"; MAP 1.1 intended purposes; MANAGE 1.1 go/no-go determination; profiles). NIST. 2023-01-26. https://doi.org/10.6028/NIST.AI.100-1 (verified: primary)