固有風險(Inherent risk)是風險管理中的一個概念,指的是在沒有任何風險控制措施的情況下,某一活動或過程所固有的、原始的風險水準。它反映了在引入任何風險緩解措施之前,風險的自然狀態[1][2]。另一種解釋是,固有風險是在現有控制措施(可能不完整或效果有限)下,風險的實際存在狀態[3][4]

在進行處置,並且增加安全措施之後的風險程度,會稱為殘餘風險英语residual risk

參考資料

编辑
  1. ^ Gregory Monahan. Enterprise Risk Management: A Methodology for Achieving Strategic Objectives. John Wiley & Sons. 2008 [2020-06-02]. ISBN 9780470372333. (原始内容存档于2019-12-15). 
  2. ^ Rachel Slabotsky. Inherent Risk vs. Residual Risk Explained in 90 Seconds. www.fairinstitute.org. FAIR Institute. 7 September 2017 [10 October 2018]. (原始内容存档于2020-04-02). Inherent risk represents the amount of risk that exists in the absence of controls. 
  3. ^ Rachel Slabotsky. Inherent Risk vs. Residual Risk Explained in 90 Seconds. www.fairinstitute.org. FAIR Institute. 7 September 2017 [10 October 2018]. (原始内容存档于2020-04-02). Inherent risk is current risk level given the existing set of controls rather than the hypothetical notion of an absence of any controls. 
  4. ^ Jack Jones. Measuring and Managing Information Risk: A FAIR Approach. FAIR Institute.