SmartSuite GRC Products assess risk with qualitative ordinal ratings and semiquantitative scores, where Formula fields turn the number behind each rating into a score and a rating from 1-Low to 5-Critical. Enterprise Risk Management and Third-Party Risk also store quantitative estimates, such as an Annual Loss Expectancy in dollars, which SmartSuite records but does not calculate.

Example: a third-party risk team assesses a new vendor engagement. The assessor answers 14 questions, the weighted Risk Score comes to 2.57, and the engagement is rated 4-Significant, which sets Level II: Standard Due Diligence and a reassessment every 18 months.

Three methods, each built into named Products. The table lists where each one lives and what it produces.

Note: SmartSuite does not run Monte Carlo simulations, FAIR (Factor Analysis of Information Risk) calculations or regression analysis. See Does SmartSuite calculate quantitative or probabilistic risk?

Each rating is a Single Select field with labeled levels, so every assessor picks from the same list. A rationale field sits beside the ratings that need an explanation.

The Risk Evaluation tab: likelihood and impact are picked from five labeled levels, inherent and residual.

Every rating choice carries a number. A Formula field reads that number with NUMERICVALUE, then multiplies, averages or weights it and bands the result back into a rating. The numbers are set in the field's Manage List with Include Value; see Formula examples: totals, text, dates and status.

Each level carries a value: Remote is 1 and Almost Certain is 5.

Likelihood and impact each carry a value from 1 to 5. Inherent Risk Score multiplies the two inherent values, so it runs from 1 to 25; Residual Risk Score multiplies the residual pair. Inherent Risk Rating and Residual Risk Rating band the score:

Example: RISK006 Professional Liability Risk is Almost Certain and Significant, so its Inherent Risk Score is 20 and its rating is 5-Critical. After its controls, the Residual Risk Score is 4, rated 2-Moderate.

Priority Quadrant places each risk by its residual values. Top Risks pair high likelihood with high impact. Critical Outliers have impact 4 or 5 and likelihood 1 or 2. Flies on the Wall have likelihood 4 or 5 and impact 1 or 2. The rest are Low Risks. Effective Controls (%) shows the share of linked controls rated effective.

The Enterprise Risk Management Dashboard carries an Inherent Risk Heat Map and a Residual Risk Heat Map. Likelihood runs across, impact runs down, and each cell shows the average score of the risks in it.

Inherent and residual heat maps on the Enterprise Risk Management Dashboard.

The Engagement RA (engagement risk assessment) measures the inherent risk of an engagement before controls. The assessor answers 14 questions in five domains, and each answer is rated from 1 to 3. Each domain's average is multiplied by its weight, and the weights total 100:

Risk Score adds the five weighted domain scores, so it runs from 1 to 3. Vendor Impact Rating bands it:

The rating sets the Due Diligence Tier. 5-Critical is Level III: Enhanced Due Diligence, 4-Significant and 3-High are Level II: Standard Due Diligence, and 2-Moderate and 1-Low are Level I: Basic Screening. A reviewer who sets Override Impact Rating replaces the calculated rating.

On the engagement, Reassessment Frequency follows the Risk Ranking: every 12 months for 5-Critical, 18 for 4-Significant, 24 for 3-High, 36 for 2-Moderate and 60 for 1-Low. The Risk Ranking Breakout section shows each domain as Low, Moderate or High.

An Engagement RA after submission: the weighted Risk Score, the rating, the tier and the ranking by domain.

A Due Diligence review measures what remains after the vendor's controls. Inherent Risk is the highest Risk Ranking among the linked engagements. Residual Risk comes from the review:

Select Complete Review to copy Residual Risk to the vendor record.

On the vendor, Vendor Risk Score combines the ratings into one number from 0 to 100, where higher is riskier. Residual risk counts 50%, the Black Kite cyber rating 20%, the FHA score from Financial Viability 15%, service level results 10% and inherent risk 5%. Missing inputs are skipped and the rest re-weighted, and open issues add up to 3 points.

Vendor Tier (Calculated) bands the score. 70 or more is Tier 1 - Critical, 50 is Tier 2 - High and 30 is Tier 3 - Moderate. 15 is Tier 4 - Low, and below 15 is Tier 5 - Minimal. Vendor Tier Override replaces it when set.

The vendor record: inherent and residual rankings, the Vendor Risk Score and the tier it sets.

In a Business Impact Analysis (BIA), Impact Assessment Score averages the numbers behind the four impact ratings. Criticality (FX) bands it: 1.5 or less is Low, up to 2.5 is Medium, up to 3.5 is High and above 3.5 is Severe.

Criticality sets default recovery targets in hours: the RTO (recovery time objective), the RPO (recovery point objective) and the MTD (maximum tolerable downtime). Each has a manual override.

A Business Impact Analysis: the impact score, the criticality it sets and the recovery targets that follow.

No. SmartSuite does not run Monte Carlo simulations, FAIR calculations or regression analysis. Two Products store quantitative figures that a person or another tool produces:

Note: these figures are inputs, not results SmartSuite calculates. A team that models loss in a FAIR or simulation tool can store the results in Currency and Number fields and chart them beside the rated risks.

Annual Loss Expectancy totaled by risk event category.

Yes. The numbers behind each rating, the domain weights and the bands are fields and formulas in the solution, so a Solution Manager or an Account Administrator can change them to match the organization's method.

Important: a Formula field recalculates every record when its formula changes, so earlier scores change with it. Ratings copied into a select field, such as Inherent Risk on a Due Diligence review past Final Review, keep their value.

Need more help? Ask the SmartSuite Community, where builders, administrators and the SmartSuite team answer questions about building on SmartSuite. For your account, billing or data, select the chat button in the lower-right corner of SmartSuite to reach support.

Last verified 4 Nov 2026.