Inherent ESG risk is the exposure an activity carries before any control is applied, and residual ESG risk is what remains after management has acted. The difference between the two is the measured effect of controls. Registers that record only one figure cannot show whether a control works or whether exposure simply fell.
The pair is a sequence, not two competing scores. Inherent risk is assessed first, on the raw characteristics of a sector, a site, a material or a supply relationship. Residual risk is assessed second, on the same issue, after policies, monitoring, contracts, engineering controls and governance have been taken into account. Recording both is what makes a register defensible to an auditor, a lender or a buyer.
The two readings side by side
| Dimension | Inherent ESG risk | Residual ESG risk |
|---|---|---|
| Measures | Exposure before controls | Exposure after controls |
| Driven by | Sector, geography, process, workforce model, material inputs | Policies, systems, monitoring, contracts, board oversight |
| Changes when | The business model or footprint changes | A control is added, strengthened or fails |
| Evidence needed | Activity data, location data, sector risk mapping | Control documents, records showing the control operated |
One published ESG risk rating methodology is built on exactly that construction: exposure less management leaves unmanaged risk, scored on a 0 to 100 scale where a lower score means lower risk, and banded into five named categories. The construction is absolute rather than peer relative, so the residual figure is meant to be comparable across sectors.
Where the distinction changes a decision
1. A high inherent, low residual issue is well controlled. The evidence burden is proving the control operated, not redesigning it. 2. A high inherent, high residual issue is the genuine priority, because management has been attempted and has not closed the gap. 3. A low inherent, low residual issue absorbs attention out of proportion to its exposure and can usually be monitored rather than worked. 4. An issue with no inherent assessment at all is the dangerous case, since a comfortable residual score may only reflect exposure that was never high, or a control nobody has tested.
The last case is why an assessor asks for the inherent rating first. Without it, a low residual number is unfalsifiable.
Sources: ESG Risk Ratings methodology, exposure less management, ISO 31000:2018, Risk management guidelines
ESG solutions covers building the register and structuring the evidence recorded against each residual assessment, while the ESG guide sets out how exposure is scored before any control is credited. The same ranked exposure areas and named gaps can be produced ahead of the first data collection.