The term inherent risk refers to the possibility of loss coming out of a situation or at work within a particular environment before any action has taken place to change or control the environment, and an example would be the possibility that a company's financial statements have included a crucial misstatement that comes from an omission or error that comes from a cause other than a simple lack of controls but instead from a situation of judgment or estimation. If a new financial institution that has a high level of exposure and trade with complex derivatives, the inherent risk is assumed to be considerably higher than it would be for an established investment company.
While inherent risk has to do with matters of judgment, two other types of risk exist in this context. The first is "control risk," which refers to the possibility of errors coming from flaws in the controls of the company. If organizations lack internal controls to protect them from situations involving error and fraud, that is a major problem. "Detection risk" refers to the chance that an auditor would simply miss a material error in the financial statements during the review process. All of these types of risk are important when making valuations and investment decisions.