An organization has just started accepting credit card payments from customers via the corporate website.

Inherent risk is the most likely to increase as a result of the new initiative, because it is the risk that exists before any controls or mitigating factors are applied. Inherent risk reflects the natural or raw level of exposure that the organization faces from a given risk source or scenario. Accepting credit card payments from customers via the corporate website introduces new sources and types of risk, such as fraud, theft, data breach, or non-compliance, that increase the inherent risk level of the organization. Risk tolerance, risk appetite, and residual risk are all related to the risk management process, but they are not the most likely to increase as a result of the new initiative, as they depend on the organization’s risk strategy, objectives, and controls. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.3.1, page 51