Methodology · reviewed 11 October 2026

Third-party risk scoring methodology

A usable score separates exposure from the evidence that reduces it.

1. Rate impact

Use a 1–5 scale anchored to consequences. Include continuity, confidentiality, legal duties, financial authority, substitutability, and downstream dependencies.

2. Rate likelihood

Rate the plausible chance that the exposure becomes an event. Use service design, threat exposure, operating history, change frequency, and dependency complexity.

3. Calculate inherent risk

Multiply impact by likelihood, then multiply by four. Example: impact 5 × likelihood 4 × 4 = 80.

4. Apply evidenced controls

Estimate control effectiveness only from current, relevant evidence. If effectiveness is 50%, an inherent score of 80 becomes a residual score of 40.

5. Compare with thresholds

Use the published bands as a starting point, then calibrate them to your organisation's risk appetite and decision rights.

Common mistakes

• Treating a vendor questionnaire response as proof.
• Mixing inherent and residual factors in one rating.
• Ignoring concentration and fourth-party dependencies.
• Using the score as an automatic approval.

Reference points

The method is a practical triage model informed by the risk concepts in ISO 31000 and supply-chain review practices in NIST SP 800-161 Rev. 1. Those publications do not prescribe this exact formula.

Calculate a score or use the scoring matrix template.