ISO/IEC 27005:2022 describes as the level of risk without considering any controls, as the level allowing for controls already implemented, and as risk remaining after treatment. State which basis each rating uses.
The standard supplies guidance rather than a mandatory scoring model, legal rule, or standalone certification scheme.
Use only when a no-controls baseline helps the decision. ISO/IEC 27005:2022 says organizations can consider inherent risk or when determining risk levels, and notes that information security methods most commonly assess current risk. is what remains after treatment and is the basis for the risk owner's acceptance decision.
Side-by-side comparison
Inherent vs residual risk: define the baseline before comparing
ISO/IEC 27005 describes an inherent level without controls, a current level that credits effective existing controls, and after treatment. Compare them only when the scenario, criteria, units, time horizon, and control assumptions are explicit.
The level of risk without considering any controls. Use this no-controls baseline only when it helps the decision and the hypothetical assumptions can be explained.
Second framework
Residual Risk
Risk remaining after treatment. Determine it through a follow-up assessment that considers proposed or implemented controls and their effectiveness.
Inherent vs residual risk: define the baseline before comparing
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Assess the same scenario after the relevant treatment, proposed controls, and expected or verified effectiveness are considered.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Use for a no-controls comparison when useful. Use for today's operating exposure and for the remaining exposure after treatment.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
The same accountable risk owner approves treatment and accepts or escalates the remaining exposure under authorized criteria.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Keep ownership of the same risk consistent across stages. Separate the risk owner from analysts, treatment owners, and control owners.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Assess after a treatment decision or control change to determine what remains and whether further treatment is required.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Assess for today's treatment decision and for acceptance after treatment. An inherent baseline does not replace either assessment.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Describe the scenario, no-controls assumptions, consequence, likelihood, method, and rationale. ISO/IEC 27005 recommends considering inherent or depending on the situation.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Consider treatment and , reassess likelihood and consequence, compare the result with acceptance criteria, and record acceptance or further treatment.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Treat inherent, current, and residual ratings as labeled views of one risk workflow, not interchangeable scores.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Evidence should show the approved treatment, controls credited, expected or tested effectiveness, follow-up assessment, acceptance decision, conditions, and review date.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
A planned control supports an expected residual estimate. Only implementation and effectiveness evidence can support a verified post-treatment rating.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Review as treatment progresses, after control tests or incidents, and at scheduled or event-driven acceptance reviews.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Set separate triggers for the underlying scenario, current control operation, treatment progress, and residual-risk acceptance.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Residual-risk evidence supports ISO/IEC 27001 treatment and acceptance decisions, but ISO/IEC 27005 is guidance rather than a standalone certification standard.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Use the approved criteria and authority model for decisions; neither rating creates legal permission to retain a risk.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
can reuse unchanged scenario facts but must add treatment, controls, effectiveness, and current evidence.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Preserve the baseline and version later assessments so reviewers can see which facts and controls changed.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Use to determine whether treatment is sufficient and whether the remaining exposure can be accepted.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
If the no-controls state is too artificial to support, assess instead and document the effective existing controls.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Scope and covered activity
Inherent
Assess the defined scenario without crediting any controls. State where this is a hypothetical condition because the activity has embedded controls.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Residual Risk
Assess the same scenario after the relevant treatment, proposed controls, and expected or verified effectiveness are considered.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Operational implication
Use for a no-controls comparison when useful. Use for today's operating exposure and for the remaining exposure after treatment.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Who must act
Inherent
The method owner defines the no-controls convention; analysts apply it; the risk owner confirms that the comparison supports the decision.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Residual Risk
The same accountable risk owner approves treatment and accepts or escalates the remaining exposure under authorized criteria.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Operational implication
Keep ownership of the same risk consistent across stages. Separate the risk owner from analysts, treatment owners, and control owners.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Trigger or threshold
Inherent
Use an inherent baseline when the approved method needs a no-controls comparison for prioritization, design, or reporting.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Residual Risk
Assess after a treatment decision or control change to determine what remains and whether further treatment is required.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Operational implication
Assess for today's treatment decision and for acceptance after treatment. An inherent baseline does not replace either assessment.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Core obligations
Inherent
Describe the scenario, no-controls assumptions, consequence, likelihood, method, and rationale. ISO/IEC 27005 recommends considering inherent or depending on the situation.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Residual Risk
Consider treatment and , reassess likelihood and consequence, compare the result with acceptance criteria, and record acceptance or further treatment.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Operational implication
Treat inherent, current, and residual ratings as labeled views of one risk workflow, not interchangeable scores.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Evidence and records
Inherent
Evidence should show the scenario, no-controls assumptions, threat and vulnerability inputs, time horizon, likelihood, consequence, and uncertainty.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Residual Risk
Evidence should show the approved treatment, controls credited, expected or tested effectiveness, follow-up assessment, acceptance decision, conditions, and review date.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Operational implication
A planned control supports an expected residual estimate. Only implementation and effectiveness evidence can support a verified post-treatment rating.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Timing and cadence
Inherent
Review when the underlying no-controls scenario, scope, objectives, criteria, or time horizon changes.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Residual Risk
Review as treatment progresses, after control tests or incidents, and at scheduled or event-driven acceptance reviews.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Operational implication
Set separate triggers for the underlying scenario, current control operation, treatment progress, and residual-risk acceptance.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Assurance limits
Inherent
An inherent-risk rating is one method option under ISO/IEC 27005, not proof of certification, compliance, or .
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Residual Risk
Residual-risk evidence supports ISO/IEC 27001 treatment and acceptance decisions, but ISO/IEC 27005 is guidance rather than a standalone certification standard.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Operational implication
Use the approved criteria and authority model for decisions; neither rating creates legal permission to retain a risk.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Overlap and reuse
Inherent
can supply the scenario, threats, vulnerabilities, likelihood, consequence, and assumptions for later analysis.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Residual Risk
can reuse unchanged scenario facts but must add treatment, controls, effectiveness, and current evidence.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Operational implication
Preserve the baseline and version later assessments so reviewers can see which facts and controls changed.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Practical decision rule
Inherent
Use when a no-controls view improves prioritization and its assumptions can be supported.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Residual Risk
Use to determine whether treatment is sufficient and whether the remaining exposure can be accepted.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Operational implication
If the no-controls state is too artificial to support, assess instead and document the effective existing controls.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
Guidance on managing information security risks
Practical decision rule
When should teams use inherent and residual risk?
Define inherent, current, and and their control assumptions in the approved method.
Use the same scenario, time horizon, units, and criteria when comparing stages.
Record whether residual is expected or verified before the risk owner decides on acceptance.
ISO/IEC 27005:2022 Clauses 6.4.3.4, 6.5, and 8.6.3 support the choice of inherent or current risk, documented methods, and follow-up assessment and acceptance of residual risk.
Guidance on managing information security risks
Search this module
Find a question or answer quickly
4 of 4 questions
Question 1
How should teams distinguish inherent risk from residual risk under ISO/IEC 27005?
ISO/IEC 27005:2022 describes as the level without considering any controls and as the level allowing for the effectiveness of controls already implemented. It defines as risk remaining after treatment. These are different assessment bases, so label the basis and control assumptions on every rating.
A no-controls inherent baseline can be useful for prioritization or comparing gross exposure, but it can be unrealistic for a process that has never operated without embedded controls. is often the more decision-useful starting point for information security treatment. After selecting or implementing treatment, reassess likelihood and consequence with the proposed controls and their effectiveness to determine .
Use the same scenario, scope, time horizon, consequence and likelihood criteria, and units when comparing stages.
List the controls excluded from , credited in , and proposed or implemented for .
Do not claim risk reduction from a control merely because it exists; consider whether it is necessary, implemented, operating, and effective.
Example: an inherent assessment of laptop data disclosure excludes disk encryption and access controls. The current assessment credits only controls operating now. A planned encryption deployment supports an expected residual estimate; implementation and effectiveness evidence are needed before treating that estimate as verified.
What is the difference between and in ISO/IEC 27005?
is the level assessed without considering any controls. is what remains after treatment. Between them, is today's exposure after crediting the effectiveness of controls already implemented. Keep the scenario, time horizon, criteria, and units constant and label which controls are excluded, credited, proposed, or verified.
Does ISO/IEC 27005 require an inherent-risk assessment?
No. ISO/IEC 27005:2022 recommends considering or depending on the situation and says information security methods most commonly use current risk. Use a no-controls baseline only when it supports the decision and its hypothetical assumptions can be explained.
Can planned controls be used to report ?
Planned controls can support an expected residual-risk estimate for treatment planning. They do not support a verified post-treatment rating until the controls are implemented and evidence shows how effectively they modify likelihood or consequence. Label the estimate accordingly and perform the follow-up assessment.
Who accepts ?
The risk owner decides whether is acceptable under the organization's approved acceptance criteria and delegated authority. If the remaining risk exceeds that authority or normal criteria, the decision should be escalated or explicitly justified and approved as the authority model requires.
ISO/IEC 27005:2022 Clauses 6.4.3.4 and 6.5 distinguish inherent and current risk; the residual-risk definition and Clause 8.6.3 explain risk remaining after treatment.
Guidance on managing information security risks
Question 2
What evidence should support the inherent vs residual risk decision?
Keep the scenario, scope, criteria, time horizon, consequence and likelihood evidence, rating basis, included and excluded controls, , uncertainty, owner, date, and rationale together. For , add the approved treatment plan, follow-up assessment, acceptance decision, conditions, and review trigger.
For an inherent rating, explain how the no-controls state was estimated and where it is hypothetical.
For a current rating, identify existing controls and evidence of their actual effectiveness.
For a residual rating, distinguish proposed effectiveness from verified effectiveness and update the rating after implementation testing.
ISO/IEC 27005:2022 Clauses 6.5, 8.3, and 8.6.3 support documented methods, evidence-based control credit, and follow-up assessment of residual likelihood and consequence.
Guidance on managing information security risks
Recommended next step
Document each risk basis
Label each rating as inherent, current, or residual; list the controls considered and record whether effectiveness is forecast or verified.
Who owns and approves inherent vs residual risk decisions?
Keep one accountable risk owner for the same risk across its inherent, current, and residual views unless the risk itself moves to a different organizational owner. Analysts can calculate the ratings and treatment owners can implement controls, but the risk owner approves the plan and decides whether is acceptable.
Name the method owner who defines the rating convention and the risk owner who makes the decision.
Assign control implementation and effectiveness evidence to treatment and control owners.
Escalate residual-risk acceptance when it exceeds the risk owner's delegated threshold or class.
ISO/IEC 27005:2022 Clauses 7.2.2 and 8.6 assign risk management, treatment-plan approval, and residual-risk acceptance to accountable risk owners.
Guidance on managing information security risks
Question 4
When should inherent vs residual risk be reviewed?
Reassess the relevant view when the scenario, criteria, evidence, controls, or treatment changes. changes when the underlying no-controls scenario changes; changes when the operating environment or existing- changes; changes as treatment is implemented, tested, changed, or fails.
Review after incidents, material changes, new threats or vulnerabilities, unexpected control tests, treatment delays, or changed acceptance criteria.
Do not carry a planned residual rating forward as though it were verified after implementation.
Record the previous basis, changed controls or evidence, new rating, and new acceptance or treatment decision.
ISO/IEC 27005:2022 Clauses 5.2, 8.6.3, and 10.8 support follow-up assessment and regular and change-driven review of risk, controls, treatment, and criteria.
Official listing for ISO/IEC 27005:2022; Clauses 6.4.3.4, 6.5, and 8.6.3 support the inherent, current, and residual-risk distinctions on this page.
ISO/IEC 27005:2022 Clauses 6.4.3.4 and 6.5 distinguish inherent and current risk; the residual-risk definition and Clause 8.6.3 explain risk remaining after treatment.
ISO/IEC 27005:2022 Clauses 6.5, 8.3, and 8.6.3 support documented methods, evidence-based control credit, and follow-up assessment of residual likelihood and consequence.
Show 4 more
ISO/IEC 27005:2022 Clauses 7.2.2 and 8.6 assign risk management, treatment-plan approval, and residual-risk acceptance to accountable risk owners.
ISO/IEC 27005:2022 Clauses 5.2, 8.6.3, and 10.8 support follow-up assessment and regular and change-driven review of risk, controls, treatment, and criteria.
Primary ISO listing for the risk-management standard that frames how teams compare untreated scenarios, controls, treatment choices, and residual risk evidence.
ISO/IEC 27005:2022 Clauses 6.4.3.4, 6.5, and 8.6.3 support the choice of inherent or current risk, documented methods, and follow-up assessment and acceptance of residual risk.
Official listing for ISO/IEC 27001:2022, whose risk-treatment requirements include risk-owner approval and acceptance of residual information security risks.
"Information security management systems — Requirements"