Original or inherent risk is the exposure before any controls, while residual risk is what is left after controls are applied. The gap between the two shows how effective your safeguards are. Risk programs work to shrink residual risk until it sits within the organization’s risk appetite.
