Risk sits at the centre of every FCA-regulated firm, yet the language used to describe it trips up even experienced compliance teams. Two terms cause the most confusion: inherent risk and residual risk. If your risk register blurs the two, your board reporting is weaker than it should be, and your evidence of control is harder to defend. This guide decodes inherent risk in the FCA context and walks you through a simple identify-assess-control workflow you can apply to your own firm this month.
What is inherent risk?
Inherent risk is the level of risk a process, product or activity carries before you apply any controls. It is the raw exposure you face by virtue of what your firm does – the fraud risk in a payments flow, the suitability risk in advice, the financial crime risk in onboarding a client you have never met.
The FCA does not demand that inherent risk be eliminated. It expects you to understand it. Under the Senior Managers and Certification Regime (SMCR) and the systems and controls rules in SYSC, firms must identify the risks arising from their business model and maintain controls proportionate to them. You cannot judge whether a control is “appropriate” without first knowing how much risk your business inherently carries.
In practical terms, inherent risk is the starting point of your risk assessment. Everything else is a response to it.
Inherent risk vs residual risk: the difference that matters
The distinction is simple. Inherent risk is the risk before controls. Residual risk is the risk left over after controls are applied.
| Term | Meaning | Example |
|---|---|---|
| Inherent risk | Exposure before any controls | Client onboarding carries a high inherent financial crime risk |
| Residual risk | Exposure remaining after controls | Enhanced due diligence and screening reduce that risk to a manageable level |
In a mature risk register, every risk entry shows both figures. The gap between them is the story: it tells your board how much protection the firm’s controls are actually delivering. A risk with a high inherent rating and a low residual rating is well managed. A risk with a high inherent rating and a high residual rating is a call to action – either strengthen the controls or stop doing the activity.
Why inherent risk matters under FCA rules
The FCA assesses firms on how well they understand and manage the risks inherent in their business. Three areas make this explicit:
- Business model and risk governance. The FCA’s threshold conditions require an appropriate business model and adequate resources. Both rest on an honest view of inherent risk.
- Financial crime (SYSC 6.1 and the Money Laundering Regulations). The business-wide risk assessment must capture inherent risk at the firm, customer, product, geography and channel level before any mitigation is credited.
- Consumer Duty. Firms must show they deliver good outcomes regardless of the inherent risks in their products, distribution and customer base.
Get inherent risk wrong and every downstream judgement – control testing, board MI, regulatory reporting – inherits the error. The financial crime rules changed on 30 June 2026 with the Money Laundering and Terrorist Financing (Amendment) Regulations 2026, which narrowed the mandatory triggers and converted euro thresholds to sterling. Inherent risk assessments completed before that date are worth revisiting.
How to identify inherent risk
Identification is a structured exercise, not a brainstorm. Work through these sources systematically:
- Business model and lines of business. What products and services do you actually deliver, and where do the loss, misconduct or financial crime exposures sit?
- Customer base. Who are your clients, and which segments carry elevated risk – vulnerable customers, politically exposed persons, high-risk jurisdictions?
- Processes and channels. Where do you rely on third parties, outsourced providers or digital channels that widen exposure?
- Regulatory obligations. Which FCA rules and PRIN principles attach to each activity?
- Change. New products, acquisitions and system changes introduce new inherent risk before any control exists.
Output every identification step into a single risk register. If a risk is not written down, it cannot be assessed or controlled.
How to assess inherent risk
Assessment turns a list into a priority order. Most FCA firms use a simple impact-and-likelihood scoring scale, rated on a consistent 1-5 or 1-4 basis:
- Rate impact. If the risk materialised, what would the regulatory, financial, customer and reputational damage be?
- Rate likelihood. How probable is the event, given your business model and customer base – ignoring your controls for now?
- Multiply to a rating. Combine impact and likelihood into a single inherent score (for example, low, medium or high).
- Document the rationale. Record why each rating was assigned. Regulators and auditors are interested in the reasoning, not just the number.
This inherent score is the before position. It tells you which risks warrant the strongest controls and the closest board attention.
How to control inherent risk
Controls reduce inherent risk to residual risk. Match control strength to inherent rating:
- High inherent risk demands layered controls – documented policies, enhanced due diligence, independent challenge, and frequent monitoring.
- Medium inherent risk calls for standard controls with regular testing.
- Low inherent risk may justify lighter, proportionate oversight.
Then do something most firms skip: re-score the risk after controls and record the residual rating. This is the step that proves your controls work, and it is the difference between a risk register that talks and one that evidences.
Common mistakes to avoid
- Confusing inherent with residual. Mixing the two flatters a weak control environment and misleads the board.
- Assessing without evidence. A rating with no reasoning will not withstand scrutiny.
- Treating the register as an annual event. Inherent risk changes with your business; review it when products, customers or rules change.
- Ignoring the residual gap. If a high inherent risk stays high after controls, escalate it – do not file it.
Getting the risk fundamentals right
A defensible inherent risk assessment gives your firm three things: a prioritised risk register, credible board reporting, and evidence the FCA can follow. It also makes every later piece of compliance work – monitoring, audits, reporting – faster, because the foundation is sound.
If you want an independent view of how your risk governance and controls stand up, an FCA compliance audit and benchmarking report benchmarks your framework against FCA expectations and returns a written report with risk ratings and practical recommendations. For ongoing support, a compliance retainer gives your firm proactive monitoring, a full template library and access to specialist FCA advisers – acting as your compliance department on a predictable monthly basis.
SPEAK TO A COMPLIANCE EXPERT
Whether you are tightening an existing risk register or building one from scratch, getting inherent risk right is the foundation everything else rests on. Talk to our team about a risk governance review or a tailored compliance retainer for your firm.
