How to build a risk scoring model for a business decision
The essentials in 30 seconds
- A risk scoring model multiplies likelihood by impact, each rated from 1 to 5, into a score from 1 to 25.
- Bands of 1 to 6, 8 to 12, and 15 to 25 turn scores into actions.
- In the illustrative example, five risks total 50 of 125, an index of 0.40.
- A currency hedge cuts the top score from 16 to 8 and the index to 0.336.
- The EQOS Asia Audit pillar lists the 3 priority risks of a situation (EQOS Asia method page, as of October 2026).
Every decision carries risks, and a score turns a long list of worries into a ranked one. This guide builds a risk scoring model on an illustrative regional expansion, from scales and a register to bands and an index. The model is one of the decision making frameworks that sit between a simple matrix and a decision engine.
On this page
Compare the EQOS Asia offers and request a 30-minute pre-diagnostic.
What is a risk scoring model and what does it return?
A risk scoring model assigns every identified risk a number so that risks can be compared and ranked. Each risk is rated on two questions: how likely is it, and how much does it matter if it occurs. The product of the two answers is the score, and the sorted list shows where attention pays most.
The model suits decisions where many risks compete for a limited management effort. It orders risks consistently, which lets a team agree on the five items to discuss instead of debating thirty. Money values can be added later for the risks at the top of the list, once the ranking is settled.
How do you define the likelihood and impact scales of a risk score?
Define both scales in words before scoring. For likelihood, 1 means rare, 3 means possible within the horizon of the decision, and 5 means almost certain. For impact, 1 means a minor cost absorbed by the budget, 3 means a delay of a quarter, and 5 means a threat to the survival of the project.
Anchor the impact scale in the firm’s own numbers, for example a share of annual profit or of the cash buffer. Shared definitions matter more than the choice of 5 levels or 10, because two people must read a 4 the same way. Write the definitions on the sheet so that the scores stay comparable next year.
Once the scores exist, a picture helps a busy board. A risk matrix places each risk by likelihood and impact on a grid with green, amber, and red zones, and it shows in one look where the sharpest exposures sit and how mitigation moves them.
How do you list and score the risks of a business decision?
Take a regional expansion, all scores illustrative. Five risks are listed: a currency swing rated 4 for likelihood and 4 for impact, a partner exit rated 2 and 5, a licence delay rated 3 and 4, a hiring shortfall rated 4 and 2, and a lease change rated 2 and 2.
The scores are 16, 10, 12, 8, and 4. Each risk also receives an owner and a date for the next review. A score without an owner is a number nobody acts on, so the register names a person for every line above the lowest band and records the next step beside it.
Seeing the method on several decisions builds confidence. The risk score examples score a key hire, a supplier contract, and a property purchase on the same scales, then compare their indexes and the highest single scores, and add a detectability factor to one risk, so that a reader sees how monitoring changes a score.
Which thresholds turn risk scores into actions?
Bands connect scores to actions. A score from 1 to 6 is accepted and monitored. A score from 8 to 12 receives a mitigation plan with an owner. A score from 15 to 25 goes to the decision maker before the decision is taken, since it may change the choice itself.
In the example, the currency swing at 16 sits in the top band, the partner exit, the licence delay, and the hiring shortfall sit in the middle band, and the lease change sits in the bottom band. One risk in the top band is enough to pause the decision until a response is agreed.
How does a mitigation change the score and the index of a decision?
An index adds the scores and divides by the maximum. Five risks at a maximum of 25 each give 125. The example total is 16 + 10 + 12 + 8 + 4, or 50, so the index is 50 divided by 125, or 0.40. Agree a decision rule beforehand, for example proceed when no risk scores 15 or more and the index stays below 0.5.
A currency hedge lowers the likelihood of the first risk from 4 to 2, so its score becomes 2 × 4, or 8. The total falls to 42 and the index to 0.336. No risk now sits in the top band and the index is under 0.5, so the rule is met. The mitigation changed the decision, and the sheet shows why.
Which weaknesses of a risk scoring model deserve attention?
Scores are ordinal, and the multiplication gives an impression of precision that the ratings cannot carry. Treat the number as a rank and keep the words of the definitions beside it. Risks that move together, such as a currency swing and a hiring cost in the same country, deserve a joint note in the register.
Calibrate the ratings with two people scoring alone and comparing. Large gaps point to missing information or to different definitions. Revisit the register at each review date and after any event, since a risk score is a snapshot and the conditions behind it change.
How does the EQOS Asia decision engine score risk at the level of a situation?
The EQOS Asia Audit pillar applies a related idea to a whole situation. It measures alignment on 9 structural dimensions, returns a φ(S) score between 0 and 1, identifies fragility zones, and lists the 3 priority risks (EQOS Asia method page, as of October 2026). A score below 0.618 falls in the STOP zone.
The computation runs in a deterministic core, so the same inputs return the same score. A reader can try a first score in the simulator, and the 30-minute pre-diagnostic by video, scheduled in Singapore time (SGT), applies the method to a real decision.
See also in this guide
Frequently asked questions
What is the difference between a risk score and a risk probability?
A probability measures how likely an event is. A risk score combines that likelihood with the impact if the event occurs, so it ranks risks by importance. Two risks with the same probability receive different scores when their impacts differ, which is why the score guides where to act first.
How many risks should a register contain?
Five to fifteen risks keep a register readable. A longer list hides the top items, and a shorter one leaves gaps. Group similar risks, score the group, and split a group only when its parts need different owners or different responses.
Who should score the risks?
Ask two or three people who know the decision, and let them score alone before comparing. Differences show missing information or unclear definitions. The decision owner approves the final scores, and the owner of each risk commits to an action and a review date.
Does the EQOS Asia method score risks?
Yes. The Audit pillar returns a φ(S) score between 0 and 1 on 9 structural dimensions, flags fragility zones, and lists the 3 priority risks of the situation (EQOS Asia method page, as of October 2026). The computation is deterministic, so the same inputs return the same score.
Test your knowledge
1. What does a risk score multiply?
- Cost by time
- Likelihood by impact
- Revenue by margin
Show the answer
Likelihood by impact.
2. What is the index of the example before the hedge?
- 0.336
- 0.50
- 0.40
Show the answer
0.40.
3. Which score band goes to the decision maker before the decision?
- 15 to 25
- 8 to 12
- 1 to 6
Show the answer
15 to 25.
4. What is the score of the currency swing after the hedge?
- 16
- 8
- 4
Show the answer
8.
5. How many priority risks does the EQOS Asia Audit pillar list?
- 2
- 5
- 3
Show the answer
3.
About the author
Stéphane Jambu
President, EQOS Forecast Asia
Stéphane Jambu leads EQOS Forecast Asia and works as a consultant in e-commerce, search visibility, and AI. LinkedIn profile
Sources: EQOS Asia method page (eqos-asia.com/method.html), simulator page (eqos-asia.com/simulator.html), and contact page (eqos-asia.com/contact.html), consulted on 21 October 2026. Page updated on 21 October 2026.