Differentiate between inherent risk and residual risk with an example.

• A. Inherent risk is the risk before controls.
• B. Inherent risk is the risk before controls; residual risk is the risk remaining after controls (e.g., cyber breach risk before a firewall vs after).
• C. Inherent risk is the risk after controls; residual risk is the risk before controls.
• D. Inherent risk is the risk before controls; residual risk is the risk eliminated by controls.

Answer: (B)