Risk Assessment Framework

Abstract

The Risk Assessment Framework translates raw investigative findings from the Prismatic Platform's due diligence pipeline into structured, quantifiable risk evaluations using a seven-dimensional scoring model. Each dimension -- Financial, Legal, Ownership, Operational, Compliance, Reputational, and Cyber -- produces a normalized score from 0 (minimal risk) to 100 (critical risk), weighted and combined into an overall risk rating expressed as both a letter grade (A through F) and a numeric score on a 300-900 scale. This scoring methodology is comparable to industry standards from SecurityScorecard and BitSight, enabling direct comparison with existing risk management workflows while providing deeper analytical granularity through its multi-dimensional decomposition and evidence-based scoring approach.

Introduction

From Data to Decision

Due diligence investigations collect vast quantities of data from 122 OSINT sources, 30+ Czech registries, and graph analysis traversals. Without a systematic framework for translating this data into actionable risk assessments, decision-makers are confronted with information overload rather than intelligence. The Risk Assessment Framework bridges the gap between evidence collection and decision support by providing a structured, reproducible, and auditable methodology for computing risk scores that directly inform M&A go/no-go decisions, compliance determinations, and counterparty acceptance.

Design Goals

The framework pursues four design goals:

1. Multi-dimensional: Risk is inherently multi-faceted. A company may have excellent financial health but critical ownership opacity. The seven-dimension model ensures that no significant risk category is overlooked.
2. Evidence-based: Every risk score is computed from verified data points, not subjective assessments. Each score carries a confidence level reflecting the quality and quantity of underlying evidence.
3. Comparable: The 300-900 numeric scale and A-F letter grades enable comparison across entities, investigations, and time periods, as well as compatibility with third-party risk rating services.
4. Auditable: The scoring methodology is transparent and deterministic. Given the same input data, the framework produces the same risk scores, and the derivation of each score can be traced to specific findings.

The Seven Risk Dimensions

Financial Risk (Weight: 20%)

Financial risk assessment evaluates the target entity's financial health, stability, and integrity through analysis of available financial indicators.

Assessment Criteria:

The financial dimension draws primarily from Czech registry data, making it one of the most robust dimensions for entities registered in the Czech Republic. For international entities, the platform supplements with data from OpenCorporates, SEC EDGAR, and credit reporting services.

Legal Risk (Weight: 20%)

Legal risk captures exposure to litigation, regulatory action, sanctions, and other legal proceedings that may materially affect the entity.

Assessment Criteria:

Sanctions screening is performed against all three major sanctions lists (OFAC SDN, EU Consolidated, UN Security Council) plus national PEP databases. A direct sanctions match on the target entity or any of its beneficial owners immediately elevates the overall risk rating to F regardless of other dimension scores.

Ownership Risk (Weight: 15%)

Ownership risk evaluates the transparency and governance quality of the entity's ownership structure, drawing heavily from graph analysis results.

Assessment Criteria:

The ownership dimension leverages the platform's graph analysis engine extensively. Multi-layered holding structures through opacity jurisdictions, combined with high change velocity, produce the highest ownership risk scores.

Operational Risk (Weight: 15%)

Operational risk assesses the entity's ability to sustain business operations and honor contractual commitments.

Assessment Criteria:

Compliance Risk (Weight: 10%)

Compliance risk measures adherence to applicable regulatory frameworks and the entity's compliance posture.

Assessment Criteria:

Reputational Risk (Weight: 10%)

Reputational risk evaluates the entity's public perception and association with controversial activities or entities.

Assessment Criteria:

Cyber Risk (Weight: 10%)

Cyber risk assesses the entity's digital security posture and exposure to cyber threats.

Assessment Criteria:

The cyber dimension leverages the platform's EASM capabilities and Prismatic Perimeter integration to provide security assessment data.

Scoring Methodology

Dimension Score Computation

Each dimension's raw score is computed by summing the scoring impacts of all detected risk indicators, capped at 100:

dimension_raw_score = min(100, sum(indicator_impacts))

The raw score is then adjusted for evidence confidence:

dimension_adjusted_score = dimension_raw_score * evidence_confidence

Where evidence_confidence is the average triple-check confidence score of the underlying data points, ranging from 0.0 to 1.0. This ensures that risk scores based on well-verified data carry more weight than scores based on low-confidence findings.

Overall Risk Score

The overall risk score combines weighted dimension scores onto the 300-900 scale:

composite = sum(dimension_adjusted_score[i] * weight[i]) for i in dimensions
overall_score = 900 - (composite * 6)

This produces a score where 900 represents minimal risk and 300 represents maximum risk, consistent with industry conventions where higher scores indicate better risk posture.

Letter Grade Mapping

Automatic Grade Overrides

Certain findings trigger automatic grade overrides regardless of the computed numeric score:

Confidence-Weighted Scoring

Evidence Quality Assessment

The risk assessment framework integrates directly with the triple-check cross-validation methodology to weight risk indicators by their evidentiary strength:

This approach prevents low-quality or unverified data from disproportionately influencing risk scores while still allowing high-confidence single-source data (e.g., a government registry) to contribute meaningfully.

Missing Data Handling

When data is unavailable for a risk dimension -- for example, when financial statements are not publicly filed -- the framework applies the Absence Informative principle from NABLA: the absence of data is itself informative. Missing financial data does not produce a zero financial risk score; instead, it produces an elevated score (typically +20-30) reflecting the increased uncertainty, with a reduced confidence level.

Temporal Risk Tracking

Risk Score Evolution

The platform maintains historical risk scores for all investigated entities, enabling trend analysis:

• Improving trend: Entity risk score has improved over successive assessments (e.g., insolvency proceedings resolved, compliance issues addressed)
• Stable trend: Risk score has remained within a narrow band across assessments
• Deteriorating trend: Risk score has worsened, indicating emerging risks
• Volatile trend: Risk score shows large swings between assessments, indicating instability

Monitoring Alerts

For entities under ongoing monitoring, the platform generates alerts when:

• Overall risk grade changes (e.g., B to C)
• Any dimension score changes by more than 15 points
• A new sanctions match or PEP connection is detected
• An insolvency proceeding is initiated
• Ownership structure changes materially

Integration with Decision Workflows

M&A Decision Support

In M&A due diligence, risk assessments feed directly into deal evaluation:

Compliance Mapping

Risk assessment results map directly to compliance framework requirements:

• NIS2: Supply chain risk assessment requirements satisfied by cyber and operational dimensions
• ZKB: Entity verification and cybersecurity assessment requirements addressed
• AML/KYC: Customer due diligence and enhanced due diligence requirements informed by financial, legal, and ownership dimensions

Conclusion

The seven-dimensional Risk Assessment Framework provides a rigorous, evidence-based methodology for quantifying entity risk in due diligence investigations. By decomposing risk into distinct dimensions, weighting scores by evidence confidence, and providing both granular dimensional scores and an overall risk rating, the framework enables decision-makers to understand not just how risky an entity is, but specifically where the risks lie and how confident the assessment is. The integration with the platform's triple-check methodology ensures that risk scores reflect verified intelligence rather than unsubstantiated indicators.

References

• Triple-Check Methodology
• Graph Analysis Engine
• Compliance Framework
• M&A Due Diligence
• OSINT Integration
• Entity Management
• EASM Capability
• Security Rating
• Risk Score
• NABLA Infinity

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator