Comparing the rating before controls (inherent risk) with residual risk shows how much the controls are relied on, and which controls most need checking.
What is residual risk?
Residual risk is the level of risk that remains after controls and treatments are in place.