What is the difference between inherent risk and residual risk, and when should each be updated?

Both scores start the same. Inherent risk reflects the vendor’s posture immediately after the assessment; residual risk should be revised over time as mitigations are applied or new issues emerge to allow ongoing tracking.