Prove exactly how much your controls reduced risk
A single inherent number can't show controls worked
Most risk registers record one number: the inherent risk of a scenario before anything is done about it. That tells an assessor what could go wrong — but says nothing about whether your investment in controls and technical and organizational measures (TOMs) actually moved the needle.
So the residual position gets rebuilt by hand. Someone re-scores scenarios in a spreadsheet after a treatment ships, the asset register drifts out of sync, and the link back to the affected processing activity is lost.
When an ISO 27001 auditor or a supervisory authority asks you to demonstrate control effectiveness, you are reconstructing the before-and-after picture under deadline.
What you can do with inherent vs residual risk scoring
- Score inherent risk for each scenario before any mitigation is applied.
- Calculate residual risk once TOMs and controls are in place.
- Track risk-after-implementation per TOM, so each measure's contribution is visible.
- Recalculate automatically when scenarios, controls, or treatments change — no manual re-scoring.
- Aggregate scores across scenarios into one risk position per asset.
- Propagate updated scores to linked RoPA and asset records with historical tracking.
What it delivers to your program
- Show auditors the before-and-after — quantified evidence that each control reduced risk, not an assertion.
- Stay current without fire drills — scores update the moment a treatment or control changes.
- Defend your control investment to the board with a measurable residual position instead of a guess.
- Keep one consistent figure everywhere — assets, scenarios, and processing activities never drift apart.
- Reconstruct any past position from historical tracking and change logs when challenged.
Built for compliance
Inherent and residual scoring supports the obligations where evidence of treatment — not just identification of risk — is what gets assessed.
| What DPMS does | Maps to | How |
|---|---|---|
| Captures risk before and after treatment | ISO 27001:2022 Clause 6.1.3 | Dual-track inherent/residual scores per scenario |
| Evidences each measure's effect | ISO 27001:2022 Clause 8.3 | Risk-after-implementation tracked per TOM |
| Documents residual risk for processing | GDPR Art. 35(7)(c) | Residual scores propagated to linked RoPA records |
| Maintains an auditable risk position over time | NIS2 Art. 21 · DORA ICT risk management | Aggregated asset scores with historical change logs |
Why Priverion
Inherent and residual scores don't sit in an isolated risk tool. Because this scoring lives inside one unified privacy and InfoSec platform, a change to a TOM recalculates the scenario, re-aggregates the asset, and updates every linked RoPA — without re-keying anything.
Unlike general-purpose GRC tools that treat risk, controls, and records as separate exports, the propagation is the product. The result is one residual position your CISO, ISO, and DPO all read the same way.
Questions risk owners ask before a demo
What's the difference between inherent and residual risk here?
Do I have to recalculate residual risk manually?
How does it aggregate risk across an asset?
Can I show how a past risk position looked?
Explore related capabilities
Ready to prove your controls work?
