Inherent risk is defined as exposure before responses and is the product of which two factors?

Inherent risk is defined as exposure before responses and is the product of which two factors?

• A. The degree to which the organization reduces risk
• B. Impact and likelihood
• C. The actions taken to mitigate risk
• D. The exposure after responses

Answer: (B)

Inherent risk is the exposure present before any actions are taken to address it. The best way to understand it is that it depends on two factors: how severe the impact would be if the risk materializes, and how likely it is to occur. When you multiply impact by likelihood, you get a measure of the starting level of risk, before any controls or responses are in place. This helps prioritize which risks to tackle first. The other ideas describe what happens after responses are applied or how much risk is reduced, not the starting, unmitigated level.

Inherent risk is the exposure present before any actions are taken to address it. The best way to understand it is that it depends on two factors: how severe the impact would be if the risk materializes, and how likely it is to occur. When you multiply impact by likelihood, you get a measure of the starting level of risk, before any controls or responses are in place. This helps prioritize which risks to tackle first.

The other ideas describe what happens after responses are applied or how much risk is reduced, not the starting, unmitigated level.