Why three numbers and not one
A single score hides the question that matters: is the risk low because the threat is small, or because expensive controls are holding it down? Inherent and residual separate the two. Target adds the promise: the score the treatment plan will deliver, with its actions and dates. Reading the three side by side is how a risk committee arbitrates, keeping a control that carries a large inherent-to-residual gap and funding the plans whose residual-to-target gap is widest.
A residual score is only as true as its controls
The residual score is where registers lie most, because it is usually typed by hand from an assumption that the controls work. In a verified model the residual inherits from the controls: each control has a status computed from evidence with a freshness date, and a control that fails or whose evidence has expired raises the residual automatically. The number then moves for a reason a reviewer can trace, instead of staying at the value someone entered a year ago.
Against the appetite
The comparison that closes the loop is residual against appetite: a residual within appetite is monitored, one above it needs a decision by the authority the gap requires, and the target must sit within appetite or the plan is not a plan. This is the reading a board pack should offer for each top risk, with the inherent to show the stake, the residual to show the state, the target to show the commitment.