Guide: risk scoring

How to build a company risk scorecard

Convert noisy public-company signals into a clear score your team can act on quickly.

Risk dimensions to score

Registration and identity

Verify registration number, legal name, and status baseline before scoring anything else.

Governance continuity

Assess director turnover patterns and cross-check leadership stability with address and filings.

Operational rhythm

Score filing frequency, update timeliness, and public-record continuity across years.

Geographic stability

Use address consistency and county history as context for physical and operational continuity.

Commercial relevance

Map risk points to your own procurement, onboarding, or credit policy thresholds.

Phase 1: Foundation (0–5 min)
Capture registration number, legal name, and status. Confirm no immediate critical mismatch.
Phase 2: Dimension scoring (5–12 min)
Score each of five dimensions on a 0–20 scale and assign policy-specific weightings.
Phase 3: Risk decision (12–15 min)
Sum points into a 100-point score and map to your existing approval policy.

Critical (0–29)

Name/address mismatches, status anomalies, or multiple unresolved identity signals.

Hold purchase and request official supporting paperwork before advancing.

Watch (30–59)

Some weak links, but not enough to reject immediately; increased verification needed.

Run deeper checks and apply manual review for high-impact decisions.

Healthy (60–100)

Consistent identity signals, stable governance context, and regular public updates.

Proceed with normal onboarding steps and periodic review cadence.

Can we use only public records for a risk scorecard?

You can build a first-pass score from public records, but higher-risk cases should also include document verification.

What should a low score trigger?

Low-score records should not be auto-approved. Route them to enhanced review with supporting documents.

Do different sectors need different weights?

Yes. Procurement risk varies by sector. Keep weights configurable so policy can reflect business context.

How often should the score be recalculated?

At least quarterly for active vendors and after key events like address or director updates.