Inherent risk is the level of risk that exists before any controls or safeguards are applied. For example, a vendor storing sensitive customer data carries high inherent risk simply because of the data involved, regardless of their security measures. It represents the raw exposure you start with.
