Can someone give me examples of inherent risk and residual risk relating to ID Theft Red Flags risk assessments? We're working on our risk assessment and one of the officers is wanting details of the difference?

Inherent risk is the risk before any controls are in place, residual risk is the risk leftover after your controls are in place.

i.e. Change of address = Moderate Risk
Mitigating measures, done in person, CIP
Residual Risk = Low

Need anything else, PM me

Thanks