# Inherent and residual risk

> The difference between risk before and after controls.

Source: https://docs.csquaregrc.com/concepts/inherent-vs-residual-risk


**Inherent risk** is the risk before any controls. **Residual risk** is what remains after your controls operate. The gap between them shows how much your controls are doing, and residual risk is what you decide to accept, transfer or treat further.