Published formula
Inherent score = impact × likelihood × 4. The 1–5 inputs produce a score from 4 to 100. Residual score = inherent score × (1 − control effectiveness). Results are rounded to the nearest whole number.
Risk bands
Low is 0–24, Moderate is 25–49, High is 50–74, and Critical is 75–100. Calibrate thresholds against your own risk appetite before using them in policy.
Worked example
Impact 4 and likelihood 3 produce an inherent score of 48. Limited controls at 25% reduce that to 36, which is Moderate.
Use the result responsibly
A score does not approve or reject a third party. Confirm evidence, document uncertainties, assign an accountable reviewer, and record the final decision separately.
See the scoring methodology or download the vendor risk scoring matrix.
Frequently asked questions
What should impact include?
Consider service disruption, data exposure, regulatory duties, financial authority, and concentration.
What does control effectiveness mean?
It is the supported reduction in the modeled risk, based on evidence rather than a vendor claim alone.