Inherent risk vs residual risk in vendor management

Inherent risk is the risk a vendor relationship carries before any of the vendor's controls are taken into account. Residual risk is the risk that remains after those controls have been assessed on evidence and any findings have been fixed, mitigated or formally accepted. The gap between the two shows how much the vendor's controls actually protect you.

Both numbers matter, for different reasons. Inherent risk decides how hard you look at a vendor. Residual risk tells you, and your board, what you are actually living with. This post explains how each is measured, how a vendor moves from one to the other, and where programs most often go wrong.

What is the difference between inherent and residual risk?

Inherent risk describes the starting position: what could go wrong given what the vendor does for you, the data it holds and the access it has. Residual risk describes the position after the vendor's defenses, and yours, are counted. NIST defines residual risk as the portion of risk remaining after security measures or controls have been applied (NIST CSRC glossary).

How is inherent risk measured?

Inherent risk is usually rated by combining two axes. The tier measures impact: how much harm a failure would cause and how hard the vendor would be to replace. Exposure measures likelihood: the data, system access and regulatory reach that create paths to harm. A matrix reads the two into one rating, such as Critical, High, Medium or Low. We walk through that matrix with a worked example in how to map vendor tiers to inherent risk.

The important point is timing. Inherent risk is set before you have seen any evidence, so it should not be softened by assumptions about how good the vendor's security probably is.

How is residual risk measured?

Residual risk comes out of the assessment. A defensible method looks like this:

1. Rate each control domain on evidence: effective, partially effective, ineffective or not evidenced. A SOC 2 report, a penetration test summary or a tested continuity plan counts as evidence; a questionnaire answer on its own does not.
2. Flag the key domains for this relationship, based on the data types and services in scope. For a payment processor, access control and encryption matter more than physical security of a sales office.
3. Apply rules, not averages. For example, an ineffective key domain keeps residual risk high regardless of how the other domains scored.
4. Raise findings for every gap that matters, each with an owner, a severity and a target date.
5. Assign the residual rating with a short written rationale that a second reviewer could re-perform.

Reading a SOC report properly is a large part of step 1: exceptions, carve-outs, subservice organizations and complementary user entity controls all affect what the report proves. That work can also be handed to experts through SOC and security report reviews.

Why residual risk should never exceed inherent risk

Controls can only reduce risk from its untreated starting point. If an assessment uncovers a situation worse than the inherent rating implied, such as access far broader than the business owner described, the inherent rating was wrong. Correct the intake answers and re-rate inherent risk, rather than recording a residual rating above it. That keeps the two numbers meaningful and the tier accurate.

How do compensating controls and risk acceptance affect residual risk?

Not every gap can be fixed before signing. Two tools bridge the difference.

Compensating controls are measures that reduce the same risk another way. If a vendor cannot yet enforce multi-factor authentication for one admin console, you might restrict that console to your network, monitor its logins or limit the data it can reach. A compensating control counts only if it is documented, owned and verified, and it should be named in the residual rationale.

Risk acceptance is a formal decision to live with a remaining risk for now. A sound risk acceptance records the rationale, any compensating controls, an owner, an approver whose authority matches the severity and an expiry date. Acceptances must be time-bound. An acceptance with no end date becomes a permanent exception that nobody revisits.

The US Interagency Guidance on Third-Party Relationships (June 2023) reflects the same thinking: where a contract cannot meet an organization's needs, it suggests considering whether the residual risks are acceptable.

What are the common pitfalls?

• Averaging away one critical gap. Thirty strong domains and one failed access control do not average out to "low". A single ineffective key control can define the residual outcome, so use rules that let it.
• Ignoring unrated controls. "Not evidenced" is not neutral. It means you have no proof either way, and it should create a finding rather than quietly count as effective.
• Relying on stale evidence. A SOC report whose period ended a year ago says little about today. Ask for a bridge letter or newer evidence before rating.
• Unverified compensating controls. If nobody confirmed the compensating control works, it should not lower the rating.
• Open-ended acceptances. Every acceptance needs an owner and an expiry date, and expired ones should surface automatically.

What should you report to the board on vendor risk?

Boards do not need every vendor. They need to know whether third-party risk is within appetite and what is changing. A useful view covers residual risk by tier and its trend, the vendors above appetite, open findings by severity and age, active risk acceptances with their approvers and expiry dates, overdue reassessments and concentration on shared providers. Showing inherent and residual side by side for Tier 1 vendors makes the value of the program visible.

With VendRisk360 board and executive reporting, these figures come from the same vendor records analysts work in, including the residual risk trend and active risk acceptances with who approved them and when they expire. Through vendor risk assessment services, VendRisk360 assessors follow findings through remediation, while risk acceptance decisions stay with you.

Frequently asked questions

What is the difference between inherent risk and residual risk?

Inherent risk is the risk a vendor relationship carries before any controls are considered, rated from the vendor's tier and its exposure. Residual risk is what remains after the vendor's controls have been assessed on evidence and findings have been remediated, mitigated or formally accepted. Inherent risk sets how deeply you assess; residual risk tells you what you are actually living with.

Can residual risk be higher than inherent risk?

It should not be. Controls can only reduce risk from the untreated starting point. If an assessment reveals more risk than the inherent rating implied, for example broader access than the business owner described, the inherent rating was understated. Correct the intake answers and re-rate inherent risk instead of recording residual risk above it.

Does risk acceptance lower residual risk?

No. Risk acceptance does not make the risk smaller; it records an approved, time-bound decision to live with it. The residual rating should stay as assessed, with the acceptance, its owner, its approver and its expiry date shown alongside it. Only remediation or a verified compensating control should lower the residual rating itself.

How often should residual risk be updated?

Update residual risk whenever its inputs change: when findings close, when new evidence arrives, when a risk acceptance expires, when a confirmed monitoring signal raises doubts about a control, and at every scheduled reassessment. A rating left untouched between annual reviews can hide a breach or a lapsed control for months.