Inherent and residual risk, explained
How ShelfGRC turns a likelihood and an impact into a rating, why each risk can carry two of them, and which one the heatmap and tolerance checks read.
5 min read
A risk can be rated twice: once before any controls, and once for what remains when controls are working.
Every risk in the Risks register is rated by its likelihood and its impact. The register shows the result twice, side by side, as the Inherent Score and the Residual Score, in your organisation's own severity labels. Each row's Risk ID is tinted in the colour of its current rating.
The two ratings
- Inherent
The rating before any controls. It comes from the Likelihood and Impact fields on the risk form. See Inherent risk.
- Residual
Your judgement of the risk that remains once controls are working. It is optional, and the register shows a dash until a residual assessment exists. See Residual risk.
A rating starts as a score and becomes a severity band through your organisation's settings.
- 1
Score the likelihood
Choose a level from 1 to 5. The default labels run from Rare to Almost Certain. See Likelihood.
- 2
Score the impact
Choose a level from 1 to 5. The default labels run from Negligible to Severe. See Impact.
- 3
Multiply the two
The score is likelihood times impact, so it runs from 1 to 25.
- 4
Read the band from the cell
The severity band is decided by the likelihood and impact cell, not by the score alone. Your organisation's severity bands set the score ranges, and an owner or admin can override individual cells. So a 3 by 4 and a 4 by 3 can carry different ratings.
Default severity bands (your organisation may have renamed or re-cut them)
- Low
Scores 1 to 8.
- Medium
Scores 9 to 14.
- High
Scores 15 to 19.
- Critical
Scores 20 to 25, or 20 to 23 on a five-band scale.
- Extreme
Five-band scale only: scores 24 to 25.
Inherent describes a risk before controls, and residual describes what is left of it once they are working.
On the risk form, Likelihood and Impact set the inherent rating, and both start at level 3. The optional Residual Likelihood and Residual Impact fields set the residual rating, and the form shows the residual severity once both are set. On a risk's own page, Add Assessment in the Risk Assessment card opens the same form when no residual rating exists yet. To remove a residual assessment, set both residual fields back to None.
These are edits like any other: they go through Propose Update and wait for approval. A risk's status (Open, Mitigating or Closed) does not change either rating. See Update a risk.
The heatmap counts the risks that match your current filters in each cell of a 5 by 5 grid.
Rows are likelihood and columns are impact, labelled with your organisation's own scale words. Each cell is coloured by the severity band it falls in, and the legend lists every band with its score range. See Risk heatmap.
The Residual / Inherent toggle above the grid
- Residual
Plots each risk at its residual cell. A risk with no residual assessment is plotted at its inherent cell.
- Inherent
Plots each risk at its inherent cell, before controls.
The same toggle decides which rating colours each Risk ID in the register. Your organisation's Risk Score Scope setting decides whether the register and the dashboard heatmap open on residual or inherent ratings.
- 1
Click a cell
A dialog lists the risks in that cell with their key, title, owner, category and score.
- 2
Filter from the inherent view
In the Inherent view, clicking a cell also filters the register to that likelihood and impact. Remove the Likelihood and Impact chips to go back.
Tolerance flags the risks rated above what their top-level category accepts.
Under Category Risk Tolerance, owners and admins set the highest severity band each top-level risk category accepts. A risk rated above its category's tolerance shows an Over tolerance chip in the register's Category column, and the Over tolerance filter shows only those risks. A category left at Not set raises no flag, and the filter stays disabled until your organisation sets tolerances. See Category risk tolerance.