> ## Documentation Index
> Fetch the complete documentation index at: https://docs.visotrust.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Risk Scoring Overview
> How VISO TRUST calculates inherent and residual risk for every vendor, combining business case exposure, data sensitivity, and control assurance.
VISO TRUST produces two risk scores for every vendor: **inherent risk** and **residual risk**. Understanding how these are calculated helps you interpret what the scores mean and how to act on them.
## The Core Formula
Everything in the VISO TRUST risk model flows from a single industry-standard principle:
```
Inherent Risk = Impact × Likelihood
Residual Risk = Impact × (Likelihood − Credit for proven security controls)
```
**Impact** answers: *If this vendor were compromised, how bad could it be?*
**Likelihood** answers: *How likely is something to go wrong?*
Both values are numeric (0 to 1 internally) and combine to produce an inherent risk score. Proven controls then reduce likelihood — the credit they earn is called **control mitigation** — and the reduced likelihood produces the residual risk score.
Impact is identical in both calculations. Controls lower risk by shrinking the likelihood of an incident, never by reducing how bad one would be.
## Step 1 — Establish Impact
Impact is driven by **data sensitivity** — the types of data your vendor handles. The most sensitive data type selected for the relationship sets the impact score.
Data types fall into sensitivity levels — None, Minimal, Moderate, Elevated, and Critical. A vendor handling payment card data (Critical) starts with a higher impact score than one handling only low-sensitivity data (Minimal).
See [Data Types](/third-parties/advanced/data-types) for the full list of data types and their sensitivity levels.
## Step 2 — Assess Likelihood (Threat Surface)
Likelihood is driven by **threat surface** — how the vendor interacts with your environment. This is determined by the **business cases** selected when configuring relationship context.
Business cases capture factors like:
* Does the vendor store or process your data?
* Does the vendor have privileged access to your systems?
* Does the vendor operate a production environment?
* Does the vendor have physical access to your facilities?
Each business case brings relevant control domains into scope and contributes to the likelihood score.
## Step 3 — Determine Controls in Scope
Not all security controls matter equally for every vendor. Based on the business cases selected, VISO TRUST automatically determines which control domains are relevant for the assessment.
A SaaS vendor on a hyperscale cloud needs different controls validated than a vendor with physical server access. Controls in scope define what evidence must be collected and reviewed.
## Step 4 — Gather and Weigh Evidence
VISO TRUST collects evidence from multiple sources:
* Independent audits (SOC 2, ISO 27001, HITRUST, PCI DSS)
* Security policies and procedures
* Technical assessments (penetration tests)
* Questionnaire responses
* Publicly available artifacts and certifications
How much risk a piece of evidence removes depends on three factors:
| Factor | What it measures |
| ------------------ | --------------------------------------------------------------------------------------------------------------- |
| **Control weight** | How much a control contributes to likelihood — its control domain's weight × the control's share of that domain |
| **Presence** | Whether the evidence shows the control is actually in place |
| **Assurance** | How trustworthy the evidence is (independent audit > self-attested policy) |
Multiplied together across every in-scope control, these produce **control mitigation** — the total credit subtracted from likelihood. See [Risk Analysis](/risk-and-monitoring/risk-analysis) for the per-control breakdown.
## Step 5 — Calculate the Scores
**Inherent Risk** is the starting point — potential risk before any controls are considered. It reflects Impact × Likelihood based solely on relationship context.
**Residual Risk** is the end point — impact applied to the likelihood that remains after control mitigation is subtracted. Risk only goes down when there's verified evidence. A vendor that claims good security practices but can't prove them gets no credit.
Both scores are mapped to risk labels:
| Label | Meaning |
| -------------- | ---------------------------------------------------------------- |
| **No Context** | Relationship context not yet configured; risk not yet calculated |
| **Low** | Limited exposure with strong controls verified |
| **Medium** | Moderate exposure; controls partially verified |
| **High** | Significant exposure or control gaps |
| **Extreme** | Critical exposure with major control gaps |
Label names and the thresholds that map to them can be customized to align with your organization's risk language. See [Your Risk Model](/risk-and-monitoring/risk-model).
## Scores Before an Assessment Completes
A relationship is scored as soon as it has context — you don't have to wait for an assessment. The instant assessment researches public sources and the model runs against whatever evidence that turns up.
Until a completed assessment backs the score, it's **transitional**. On the Relationships list a transitional score is shown in italics with an asterisk (`*`). Treat it as a starting estimate: it reflects the relationship context plus whatever public evidence exists, not reviewed documentation. The marker clears once an assessment completes, and the score then rests on analyzed evidence.
A score also goes back to transitional while a new assessment is in progress, since the result isn't settled yet.
## Predicted Context
Context — the intake answers and data classification — is what drives impact and likelihood, so it has to be right before the score means much. VISO TRUST can propose it for you.
Prediction runs on its own when you add a relationship with **Predict relationship context and instantly assess** selected. You can also run it later: open the **Relationship configuration** dialog and select **Predict relationship context**. Either way, VISO TRUST fills in the intake questionnaire and data classification from what it knows about the vendor, and the section header changes to **Context predicted by VISO TRUST** — hover it to see the reasoning behind the prediction.
Whether prediction happens automatically for new relationships is an org-level default in **Settings → Assessments**.
A predicted context is a suggestion, not a confirmation. Review the intake answers and data types before relying on the resulting score — an incorrect data type changes impact, and incorrect business cases change which controls are in scope.
## What Drives Score Changes
Risk scores update automatically when:
* New artifacts are uploaded or analyzed
* Business cases or data types are changed
* Artifacts expire (reducing assurance on previously credited controls)
* New risk advisories are detected (flagged as pending changes)
* An assessment update runs
Focus on **residual risk** when prioritizing your workload — it's the most actionable number. A vendor with high inherent risk but strong controls may be lower priority than one with medium inherent risk but unvalidated controls.
To see these steps applied to a specific vendor — with the actual impact, likelihood, and mitigation values behind their score — see [Risk Analysis](/risk-and-monitoring/risk-analysis).