nherent Risk Explained

Inherent Risk Explained: What It Is, Examples, and How to Manage It in Your Risk Register

If you have ever sat down to complete an FCA-compliant risk register and wondered why the same risk keeps appearing with two different ratings, you have met the difference between inherent risk and residual risk. It is one of the most common points of confusion in UK financial services compliance – and one that examiners, board members and SMCR senior managers notice quickly.

This guide explains what inherent risk is, how it differs from residual risk, and how to score and manage it properly in your risk register. It is written for owners, directors and Compliance Officers at FCA-regulated firms who wear several hats and need a clear, practical answer.

What Is Inherent Risk?

Inherent risk is the level of risk that exists before any controls, mitigations or safeguards are applied. It is the raw exposure a business activity carries in its purest form, assuming that no existing process, system, policy or person is there to reduce it.

Think of it this way: the inherent risk is the danger a hazard would present if your firm did absolutely nothing about it. For example, the inherent risk of accepting large transfers from a new corporate client is high, because the activity itself carries a meaningful exposure to money laundering regardless of what you do about it.

Almost every control domain in an FCA-regulated firm can be assessed through inherent risk, including:

• Client money and asset handling
• AML and financial crime exposure
• Fair value and Consumer Duty outcomes
• Outsourcing and third-party reliance
• Conduct and culture risk
• Operational resilience and IT continuity

Inherent Risk vs Residual Risk

The distinction matters because regulators expect both to appear in your risk management framework.

• Inherent risk is the risk before controls.
• Residual risk is the risk that remains after controls have been designed and operated effectively.

A workable formula many firms use is: Residual risk = Inherent risk minus the mitigating effect of your controls.

Neither figure is aspirational. Both must be evidenced. If your risk register only captures residual risk, you cannot demonstrate that your controls actually do anything – because you never recorded the starting point they were meant to reduce. A reviewer will reasonably ask: “How do we know the controls are working if we never recorded what the risk was without them?”

Worked Examples Across the Three Lines of Defence

Risk appetite and the three lines of defence framework give you a structure for recording inherent risk consistently. Here is how the same inherent risk flows through each decision level.

Example 1: New client onboarding (AML)

• Inherent risk: High. Accepting a new corporate client with a complex ownership structure carries a high level of risk purely by activity, before any checks happen.
• Controls: Enhanced customer due diligence, beneficial-ownership verification, PEP screening and transaction monitoring.
• Residual risk: Low, provided those controls operate effectively – and a moderate rating if a gap exists in your CDD documentation.

Example 2: Outsourcing your core platform

• Inherent risk: High. Relying on a single third-party provider for core processing generates significant operational risk before mitigation.
• Controls: A documented outsourcing assessment, service level agreements, business continuity plans and regular due diligence.
• Residual risk: Medium, reflecting that even with good oversight, concentration risk remains under your direction.

Example 3: Client data and confidentiality

• Inherent risk: High. Holding personal data is sensitive in isolation.
• Controls: Access controls, encryption, staff training and incident response.
• Residual risk: Low once operating, but the residual figure rises if training is overdue or access is only occasionally reviewed.

How to Score and Document Inherent Risk in Your FCA Risk Register

Here is a repeatable, step-by-step method you can use to complete an inherent risk register that stands up to internal audit and to FCA scrutiny.

Step 1. Identify the risk inventory before adding any control detail.
List each business activity or regulatory obligation as a risk on its own, bare. Do not pre-emptively “fix” it with a control description. If a risk only makes sense with its control attached, you are describing the residual position, not the inherent one.

Step 2. Score inherent likelihood and inherent impact.
Use a consistent scale across the whole register – typically 1 to 5 for each of likelihood and impact, with a documented definition of what each number means for your firm. Be honest: the inherent likelihood of a risk event for a manual payment process is higher than the mitigated likelihood.

Step 3. Calculate the inherent risk rating.
Multiply your inherent likelihood score by your inherent impact score to produce an inherent rating between 1 and 25. Use the same scale for residual later, so the two are directly comparable and you can demonstrate that controls have reduced the rating.

Step 4. Document the controls separately.
Record each control as a distinct line: what it is, who owns it, and how its effectiveness is evidenced. This is where your regulatory obligations and monitoring plan come in. A control does not count unless it is operated and evidenced.

Step 5. Re-score for residual risk.
Re-score likelihood and impact assuming your controls are working, to produce a residual rating. The gap between inherent and residual is your quantified proof of control effectiveness – and the figure your board, your Compliance Officer and an FCA reviewer will interrogate.

Step 6. Review periodically.
Inherent risk is not static. Whenever a product, client base, service, system or process changes, revisit the inherent score. A change to your controls does not change the inherent risk – but it does change the residual one, and both should be updated to reflect reality.

What the FCA Expects

The FCA does not prescribe a single risk register template, but it does expect firms to operate an effective risk management framework. Senior managers under SMCR and the overall governance responsibility are expected to understand and evidence the firm’s risk profile. Consumer Duty and fair value assessment likewise depend on firms demonstrating that risk has been identified and mitigated – which requires the inherent starting point to have been captured.

Conclusion

Understanding inherent risk is the foundation of a credible risk register. It tells you – and your regulator – the true underlying exposure of each activity, and it is the only way to prove that your controls matter.

If you want a more disciplined, defensible approach to inherent and residual risk scoring but do not have the time to build it from scratch, you do not have to. An independent compliance benchmark audit or a strategic risk management programme can help you build a robust risk register, map it to the three lines of defence, and walk you through the SMCR expectations.

SPEAK TO A COMPLIANCE EXPERT to have your firm’s risk register and risk-management approach assessed for FCA readiness.