Inherent and residual risk

Inherent risk is the risk before any controls. Residual risk is what remains after your controls operate. The gap between them shows how much your controls are doing, and residual risk is what you decide to accept, transfer or treat further.