✅ Feature availability: While the Risks page is included on all plans, Advanced Risk Management features (including custom risk rubrics and using multiple risk registers) are only available as an upgrade or add-on. Refer to Vanta Plans and Pricing for details.
Risk scoring is a core part of Risk Management in Vanta, helping you evaluate, prioritize, and report on risk consistently across your organization. Your risk scoring rubric standardizes how risks are assessed and categorized. It defines how risk scores and risk levels are determined and powers the insights shown in reports and snapshots.
⚙️ User permissions: Admins and Editors can view and edit the risk scoring rubric in risk settings. Collaborators can be assigned as Risk Scenario Owners and reference the rubric during risk assessments, but can't access the rubric in risk settings. Learn more: User Permissions by Product Area
Understanding risk scoring
A risk scoring rubric is used to evaluate risk scenarios during risk assessments and visualize risk data in reports and snapshots. Key concepts:
Ratings: Risks are evaluated across two dimensions (likelihood and impact by default). During a risk assessment, you select ratings for each dimension. The scoring method (simple scale or aggregate factors) determines whether you select each dimension's rating directly, or select ratings for individual factors that roll up into it.
Scores: The likelihood and impact ratings are used to calculate inherent and residual risk scores.
Levels: Risk scores are mapped to a risk level, which groups and interprets the severity of the score.
Metric | What it represents | How it’s used |
Likelihood rating | How likely a risk is to occur | You select ratings when conducting a risk assessment for both inherent risk (before treatment) and residual risk (after treatment). |
Impact rating | The severity of the risk if it occurs | You select ratings when conducting a risk assessment for both inherent risk (before treatment) and residual risk (after treatment). |
Inherent risk score | Likelihood × impact before treatment | Vanta calculates a score from your inputs and maps it to an inherent risk level. |
Residual risk score | Likelihood × impact after treatment | Vanta calculates a score from your inputs and maps it to a residual risk level. |
Risk level | The classification of a risk based on its risk score | Vanta maps each inherent and residual risk score to a risk level, which is used to prioritize and report on risk. |
💡 Tip: During a risk assessment, you evaluate each risk twice using the same rubric: once before selecting a treatment approach to determine the inherent risk score, and once after to determine the residual risk score. We recommend configuring your risk scoring rubric before adding or importing risks so that risk scores and risk levels reflect your methodology from the start.
Simple scale scoring method
Simple scale scoring method
Simple scale is the default scoring method. During risk assessments, you select an overall rating for the dimension directly from a defined set of values.
Example: Both Likelihood and Impact dimensions use a 1–5 scale.
Likelihood is rated 4
Impact is rated 3
The risk score is 4 × 3 = 12
Aggregate factors scoring method
Aggregate factors scoring method
Aggregate factors let you break a dimension into factors and assign each one a rating. Those individual factor ratings are used to calculate the overall rating for the dimension. You can choose a roll-up method that determines how the overall rating is calculated:
Method | Calculation |
Average | Sum of all factor ratings divided by the total number of factors (the overall rating can be a decimal value, shown to two decimal places) |
Max | Highest factor rating is used as the overall rating |
Sum | Sum of all factor ratings is used as the overall rating |
Example: The Likelihood dimension is made up of two factors, Threat and Vulnerability, each rated on a 1–5 scale. Whereas the Impact dimension uses a simple scale from 1–5.
Threat is rated 4 and Vulnerability is rated 3
Using an Average roll-up method, Likelihood is (4 + 3) ÷ 2 = 3.5
Impact is rated 3
The risk score is 3.5 × 3 = 10.5
💡 Tip: When setting up the factor, enable the allow assessors to mark this factor N/A setting to give people the option to mark an individual factor N/A during an assessment—this means the factor won't be counted when calculating the overall rating.
Editing risk scoring rubrics
Depending on your plan, you can edit your default risk scoring rubric or create register-specific scoring rubrics to customize risk level groups and dimensions. Otherwise, your account uses Vanta's default rubric settings, designed by our GRC experts to support common risk assessment methodologies.
⚠️ Note: If you edit settings that affect how scores are calculated (like dimension rating scales, factors, or roll-up methods), affected risk scenarios may need to be reassessed. You can ask the Vanta Agent to help you rescore them—it will propose ratings for each affected factor or dimension and allow you to review and sign off on all changes.
Default rubric
Default rubric
Your default rubric is the baseline scoring framework used across your risk registers.
To edit the default rubric:
Go to Settings.
From the page menu, select Risk and go to the Scoring tab.
Under Default rubric, click Edit.
Edit the settings as desired.
Click Save to select which registers to apply your changes to.
ℹ️ Note: Any registers you exclude from the update automatically use their own register-specific rubric going forward.
Rubrics by register
Rubrics by register
If you're using multiple risk registers, each register can use the default rubric or its own register-specific rubric.
To edit a register-specific rubric:
Go to Settings.
From the page menu, select Risk and go to the Scoring tab.
Under Rubrics by register, you can see whether a register is using the default rubric or a register-specific rubric.
Find the register you want to update and click to open its settings:
Click Edit to customize the settings as desired.
Click ••• to revert to the default rubric.
Click Save.
A few things to keep in mind when using register-specific rubrics:
If your registers use different rating scales or risk level configurations, you'll need to filter by register in your risk reports. This is because charts can't combine registers that use different scoring configurations into a single view.
CSV import and export across all registers are disabled when using register-specific rubrics—you'll need to import or export one register at a time.
Register-specific rubrics are managed one register at a time—edits to one register's rubric don't apply to any other register. Changes you make to the default rubric will apply to the registers you select when updating it.
💡 Tip: To copy a register-specific rubric to another register, you can ask the Vanta Agent. The agent will show you the proposed changes to review before applying them. Try the following prompt, editing as needed given your use case: "Please update [RegisterName] to use the same risk rubric as [RegisterName]. I want to apply the same risk levels, dimensions, and factors."
Risk level groups
Risk level groups
Risk levels define how risk scores are grouped and interpreted. By default, risk levels are grouped into three levels, and you can customize both the number of levels and how risk scores map to each level.
Set the number of levels: Choose how many risk level groups to use (between 2–5).
Define score ranges: Use the slider to set the range to use for risk scores. If a score falls exactly on the boundary between two levels, it's grouped into the higher level. The available range depends on settings in your dimension rating scales.
Customize each level: Edit the label and description for each risk level to reflect how your organization interprets risk.
These settings determine how both inherent risk scores and residual risk scores are categorized and displayed in reports and snapshots.
Dimensions (rating scales and scoring methods)
Dimensions (rating scales and scoring methods)
The settings for each dimension determine what ratings people can select during a risk assessment. Those ratings are then used to calculate scores for both inherent and residual risk.
You can customize the following for each dimension to match your organization's approach:
Edit the dimension name and description
Choose a scoring method for each dimension
Adjust the number of ratings in each rating scale
Define labels and descriptions for each rating
Editing dimensions
A risk scoring rubric can have two dimensions. By default, these dimensions are named Likelihood and Impact, each using a 5-point rating scale.
To edit the default dimensions:
Open the rubric you’d like to edit.
Scroll to Dimensions.
For each dimension:
Update the Name and Description for the dimension.
Under Scoring method, choose between Simple scale or Aggregate factors to customize the rating scales.
Using a simple scale
Simple scale is the default scoring method. During risk assessments, you select an overall rating for the dimension directly from a defined set of values.
To use the simple scale scoring method:
Open the rubric you’d like to edit.
Under Scoring method, select Simple scale.
Update each dimension as desired:
Update the Name and Description for the dimension.
Set the Scale range (between 2–10).
Next to each rating, click the ✎ pencil icon to add a Name and Description to guide consistent scoring.
At the top of the page, review your Risk level groups to confirm they reflect the appropriate ranges as defined by your rating scales.
Click Save.
Using aggregate factors
Aggregate factors let you break a dimension into factors and assign each one a rating. Those individual factor ratings are used to calculate the overall rating for the dimension.
To use the aggregate factors scoring method:
Open the rubric you’d like to edit.
Under Scoring method, select Aggregate factors.
Next to Roll up with, select how the overall rating for the dimension is calculated: Average, Max, or Sum.
Add factors to the dimension:
Use the default factors provided to get started, or type a factor name to create a new one from scratch.
Each factor is specific to the rubric—changes you make to a register-specific rubric won't affect other rubrics, even if it uses a factor with the same name. Changes you make to the default rubric will apply to the registers you select when updating it.
Scroll down to Factors used in this rubric to edit each factor as desired:
Update the Name and Description for the factor.
Set the Scale range for the factor (between 2–10).
Next to each rating, click the ✎ pencil icon to add a Name and Description.
Turn on Allow assessors to mark this factor N/A to give people the option to mark a factor N/A during an assessment, which excludes it from the scoring calculation.
At the top of the page, review your Risk level groups to confirm they reflect the appropriate ranges as defined by your rating scales.
Click Save.
⚠️ Note: During a risk assessment, you evaluate both inherent risk and residual risk.
When using aggregate factors, you’ll select individual ratings per factor for inherent risk, which are used to automatically calculate the overall rating for the dimension.
For residual risk, you'll select an overall rating for the dimension directly, instead of scoring individual factors—like you would if you were using the simple scale scoring method. The numeric range you can choose from still reflects your factor setup and roll-up method, the same way it does for inherent risk.
