What is the difference between inherent and residual risk?

Inherent risk is the exposure present before controls or mitigation are considered. Residual risk is what remains after safeguards are assessed. Inherent risk helps set assessment depth; residual risk helps decide whether the remaining exposure is acceptable.