Inherent risk: The risk to an entity in the absence of any mitigation plans and actions by leadership.