CRISC - Domain 2: Risk Assessment - Inherent and Residual Risk