Scoring Vendor Dependency Risk

When you rely on outside companies for key services, it’s easy to get into a tricky spot. You need to know how much you’re depending on them and what happens if they suddenly can’t deliver. This is where vendor dependency risk scoring comes in. It’s basically a way to figure out how risky it is if one of your vendors goes belly-up or just doesn’t perform. We’ll break down how to look at this, figure out the scores, and what to do about it.

Key Takeaways

Understanding vendor dependency risk scoring means knowing how much your business relies on outside suppliers and the potential problems if they fail.
You need a clear plan to identify your most important vendors, sort them by how much you depend on them, and figure out the impact if they stop working.
To score this risk, you have to guess how likely a vendor might fail and how bad it would be, using past info and some educated guesses.
Building a scoring model involves finding risks, looking at how often problems might happen and how severe they’d be, and deciding what level of risk is okay.
Having backup plans and checking on your vendors regularly helps manage the risks you find.

Understanding Vendor Dependency Risk Scoring

Vendor dependency risk scoring is all about figuring out how much trouble we could be in if one of our key suppliers or service providers suddenly can’t deliver. It’s not just about whether they’re late with a delivery; it’s about the bigger picture – what happens to our operations, our finances, and our reputation if they fail completely. We need a clear way to measure this risk so we can prioritize where to focus our attention.

Defining Vendor Dependency Risk

This type of risk refers to the potential negative impact on a business resulting from its reliance on external vendors for critical products, services, or functions. Think about it like this: if your business relies heavily on a single software provider for its core operations, and that provider experiences a major outage or goes out of business, your own operations could grind to a halt. This isn’t just an inconvenience; it’s a direct threat to your ability to function. The risk is amplified by factors like the vendor’s financial stability, their own supply chain issues, or even geopolitical events affecting their operations. It’s about understanding the interconnectedness of our business with others.

The Importance of Vendor Dependency Risk Scoring

Why bother scoring this risk? Because not all vendor relationships carry the same weight. Some vendors are essential to our daily operations, while others are less critical. Scoring helps us differentiate. It allows us to allocate resources effectively, focusing our mitigation efforts on the vendors that pose the greatest threat. Without a scoring system, we might be spending a lot of time and money managing risks that are unlikely to materialize, while neglecting the ones that could cause significant damage. It’s a way to bring order to what could otherwise be a chaotic situation, helping us make smarter decisions about where to invest our risk management budget. This is similar to how insurers assess risk before offering coverage, looking at factors like probability and severity of potential losses.

Key Components of Vendor Dependency Risk

Several factors go into determining a vendor dependency risk score. We need to look at:

Criticality of the Vendor’s Service: How vital is the product or service to our core business functions? Can we operate without it?
Vendor’s Financial Health: Is the vendor financially stable? Are there signs of distress that could lead to failure?
Concentration of Dependency: Are we overly reliant on this single vendor, or do we have alternatives?
Geographic Location and Geopolitical Factors: Where is the vendor located, and are there any political or environmental risks in that region that could impact their operations?
Vendor’s Own Risk Management Practices: Does the vendor have its own robust plans for managing risks, including business continuity and disaster recovery?

We can think of this like building a profile for each vendor. The more points we assign to the ‘high risk’ categories, the higher the overall score will be. This structured approach helps us see the full picture. For instance, a vendor might be financially sound but located in a region prone to natural disasters, creating a unique risk profile.

Establishing A Framework For Vendor Risk Assessment

Identifying Critical Vendor Relationships

When you’re looking at all the companies you work with, it’s easy to get overwhelmed. Not all vendor relationships carry the same weight, though. Some are just about day-to-day supplies, while others are so tied into your core operations that if they stumbled, your whole business could be in trouble. We need to figure out which ones are the critical ones. Think about vendors that handle your sensitive data, provide essential services that keep your lights on, or whose failure would directly stop you from serving your customers. It’s about mapping out who your business absolutely can’t do without.

Here’s a way to start thinking about it:

Direct Impact on Operations: Does their service or product directly enable your primary business functions? If they stop, do you stop?
Data Sensitivity: Do they have access to or store your customer data, financial information, or intellectual property?
Financial Exposure: Would their failure lead to significant financial losses beyond just the cost of replacing their service?
Regulatory Compliance: Is their service tied to meeting legal or regulatory requirements? A failure here could mean fines or shutdowns.

Identifying these critical vendors isn’t just an administrative task; it’s a strategic imperative. It helps focus your limited resources on the relationships that pose the biggest potential threat to your business continuity.

Categorizing Vendor Dependencies

Once you know who your critical vendors are, the next step is to sort them. Not all critical vendors are the same, and understanding the type of dependency you have helps tailor your risk assessment. Are you relying on them for a specific piece of technology, a unique service, or a large volume of goods? This categorization helps you see patterns and potential single points of failure across your vendor ecosystem. For example, you might have several vendors providing cloud storage, but one might be handling your most sensitive client records, making that dependency different from the others.

Consider these categories:

Technology/Software: Vendors providing essential software, hardware, or cloud services.
Service Providers: Companies offering outsourced functions like customer support, IT management, or logistics.
Supply Chain: Suppliers of raw materials or components vital to your product.
Data Processors: Vendors handling sensitive data on your behalf.

Assessing Potential Impact of Vendor Failure

So, you’ve identified your critical vendors and categorized your dependencies. Now, let’s get real about what happens if one of them goes belly-up. This isn’t about predicting the future with certainty, but about understanding the potential fallout. We need to think about the severity of the impact. Would it be a minor hiccup, a significant disruption, or a catastrophic event that could put you out of business? This assessment helps prioritize where you need to put the most effort into risk mitigation. It’s about asking, "What’s the worst that could happen, and how bad would it really be?" This is where understanding priority of coverage in insurance can sometimes be a useful analogy for how different failures might cascade or be handled.

Think about these impact areas:

Operational Disruption: How long would it take to get back to normal operations?
Financial Loss: What are the direct and indirect costs associated with the failure?
Reputational Damage: How would this failure affect your brand and customer trust?
Legal and Regulatory Consequences: Are there penalties or compliance issues that arise?

We can even try to put some numbers to this, though it’s often more of an educated guess. For instance, you might estimate:

Impact Area	Medium Impact (Weeks/Significant Cost)	High Impact (Months/Catastrophic Cost)
Operational Disruption	X
Financial Loss		X
Reputational Damage	X
Legal/Regulatory		X

Quantifying Vendor Dependency Risk

So, how do we put a number on how much it would hurt if a key vendor suddenly went belly-up? It’s not just about guessing; it’s about a structured approach. We need to look at two main things: how likely is it that a vendor will fail, and if they do, how bad will the fallout be for us?

Probability and Severity of Vendor Loss

Thinking about vendor failure involves considering both how often something might go wrong and how big the problem would be if it did. It’s like looking at a storm: is it a light shower that’s a minor inconvenience, or a full-blown hurricane that causes widespread damage? We need to assess these possibilities for each critical vendor.

Here’s a way to break it down:

Likelihood of Failure: This looks at factors like the vendor’s financial health, their market position, operational stability, and any recent negative news. Are they a solid, established company, or are they showing signs of strain?
Impact of Failure: This is about what happens to our business if they go under. Does their service stop a critical process? Do we have readily available alternatives? What are the financial losses, reputational damage, and operational disruptions?

Leveraging Historical Data and Predictive Modeling

We don’t have to go into this blind. Insurers, for example, spend a lot of time looking at past claims to figure out future risks. We can do something similar. By examining historical data – maybe from past vendor issues within our own company or industry trends – we can start to see patterns. Predictive modeling takes this a step further, using complex algorithms to forecast potential problems based on various data points. It’s about using what we know about the past and present to make educated guesses about the future. This can help us identify vendors who might be at higher risk before a problem actually occurs. It’s a bit like looking at weather forecasts to prepare for a storm, rather than just reacting when the rain starts.

Incorporating Professional Judgment in Scoring

While data and models are great, they aren’t the whole story. Sometimes, you just have a gut feeling about a situation, or you know something specific about a vendor that the data doesn’t capture. That’s where professional judgment comes in. Experienced people in your organization – maybe those who manage the vendor relationships or understand the technical aspects of the service – can add a layer of insight. They might know about internal issues at the vendor company that aren’t public, or they might understand the true criticality of a service in a way a spreadsheet can’t. Combining hard data with experienced human insight is key to a realistic risk score. This blend helps refine the scores, making them more accurate and actionable. It’s about not letting the numbers tell the whole story without considering the human element and specific context. For instance, understanding fiduciary liability can be complex and often requires more than just raw data to assess properly.

Developing Vendor Dependency Risk Scoring Models

Building a solid model for scoring vendor dependency risk isn’t just about picking numbers; it’s about creating a system that actually tells you where you’re most vulnerable. Think of it like building a house – you need a strong foundation and a clear blueprint before you start hammering nails.

Risk Identification and Information Gathering

First things first, you’ve got to know who your vendors are and what they do for you. This means listing out every vendor, but more importantly, figuring out which ones are absolutely critical. If this vendor disappears tomorrow, does your business grind to a halt? That’s a critical vendor. You’ll need to gather details about their services, how integrated they are into your operations, and what their own business continuity plans look like. It’s a lot of digging, but you can’t score what you don’t know.

Identify all vendors.
Determine criticality based on service impact.
Collect vendor operational and financial data.
Understand their own risk management practices.

Analyzing Frequency and Severity of Potential Losses

Once you know who your critical vendors are, you need to think about what happens if they fail. This is where we look at two main things: how likely is it to happen (frequency) and how bad would it be if it did (severity). A vendor that provides a minor, easily replaceable service might fail often, but the impact is low. On the other hand, a vendor providing a core, unique service might rarely fail, but if they do, the consequences could be huge. We’re trying to get a handle on both ends of that spectrum. This is similar to how insurers assess transportation liability insurance modeling, looking at both how often accidents happen and how costly they are.

Risk Factor	Description
Frequency	How often a vendor failure event is likely to occur.
Severity	The magnitude of the impact (financial, operational, reputational) if failure occurs.
Interdependency	How many internal processes or other vendors rely on this specific vendor.

The goal here isn’t to predict the future with perfect accuracy, but to create a realistic assessment of potential downsides. It’s about understanding the range of possible outcomes.

Defining Acceptable Risk Thresholds

So, you’ve identified your critical vendors, and you’ve thought about how bad it could be if they fail. Now, what are you willing to live with? This is about setting your risk appetite. For some vendors, a minor disruption might be acceptable, but for others, any disruption is a no-go. You need to define what level of dependency risk is too high for your organization. This might involve setting specific scores that trigger further action, like requiring a vendor to improve their security or developing a backup plan. It’s about drawing a line in the sand based on your business objectives and tolerance for disruption. This is where the scoring model starts to become a practical tool, not just an academic exercise. It helps guide decisions about which vendor relationships need immediate attention and which ones can be monitored more passively. For businesses in sectors with high stakes, like energy, understanding these thresholds is vital for project feasibility and financial stability, much like how energy insurance contracts are structured to cover specific risks.

Implementing Vendor Risk Mitigation Strategies

Once you’ve figured out how dependent your business is on certain vendors and what the potential fallout could be if they falter, the next logical step is to actually do something about it. This isn’t about just crossing your fingers and hoping for the best; it’s about putting concrete plans in place. Think of it like having a good insurance policy for your business relationships.

Contractual Risk Transfer and Guarantees

This is where you get specific with your vendors about who’s responsible for what. It’s about making sure the contract clearly outlines responsibilities and consequences. You can include clauses that transfer certain risks back to the vendor, like requiring them to maintain specific levels of insurance or to guarantee certain performance standards. For critical vendors, you might even look into performance bonds or other financial guarantees that provide a safety net if they can’t deliver.

Service Level Agreements (SLAs): Define clear performance metrics and uptime guarantees.
Indemnification Clauses: Specify who covers costs if a third party is harmed due to the vendor’s actions.
Insurance Requirements: Mandate that vendors carry specific types and amounts of insurance.
Performance Bonds: For high-stakes relationships, require a bond that pays out if contractual obligations aren’t met.

The goal here is to ensure that if something goes wrong with the vendor’s service or product, the financial and operational impact on your business is minimized, and the responsibility is clearly assigned.

Enhancing Vendor Oversight and Audits

Contracts are great, but they’re just paper if no one checks if they’re being followed. Regular oversight is key. This means more than just occasional check-ins. You should be actively monitoring vendor performance against those SLAs we just talked about. Audits, whether they’re internal or third-party, are also super important. These aren’t meant to be punitive, but rather to verify that the vendor is operating as agreed and meeting security, compliance, and operational standards. Think of it as a regular health check for your vendor relationships. This can include reviewing their financial stability, security practices, and compliance records. For instance, if a vendor handles sensitive customer data, you’ll want to audit their data protection measures regularly.

Developing Contingency and Business Continuity Plans

Even with the best contracts and oversight, things can still go sideways. That’s where contingency and business continuity plans come in. These are your backup plans. What happens if your primary vendor suddenly goes out of business or experiences a major disruption? You need to have a plan B. This might involve identifying alternative vendors, having backup inventory, or developing internal capabilities to cover critical functions temporarily. It’s about building resilience into your supply chain and operations. A good plan will detail steps for immediate response, communication protocols, and how to transition to backup solutions with minimal disruption. This is where having a solid contingent interruption recovery system can make all the difference.

Here’s a quick look at what goes into these plans:

Identify Critical Functions: Pinpoint the business processes that rely heavily on specific vendors.
Develop Alternative Solutions: Research and pre-qualify backup vendors or internal workarounds.
Create Communication Protocols: Establish how you’ll communicate with vendors, employees, and customers during a disruption.
Test and Refine: Regularly test your contingency plans to ensure they are effective and up-to-date.

The Role of Data In Vendor Risk Management

Data is the bedrock of effective vendor risk management. Without solid information, any attempt to score or manage vendor dependency risk is essentially guesswork. Think of it like trying to build a house without blueprints or materials – you might end up with something, but it’s unlikely to be stable or meet your needs.

Utilizing Claims Data for Trend Analysis

When we talk about data, claims data is a goldmine. Insurers, for example, spend a lot of time looking at claims to figure out what’s happening. They analyze things like how often certain types of losses occur (frequency) and how big those losses tend to be (severity). This helps them understand patterns and predict future issues. For vendor risk, this means looking at past incidents involving vendors – maybe a service outage, a data breach, or a compliance failure. By tracking these events, we can start to see trends. Are certain types of vendors more prone to problems? Are there specific industries or regions that pose a higher risk? This kind of analysis helps us move beyond just reacting to problems and start anticipating them.

Applying Analytics for Risk Refinement

Just collecting data isn’t enough, though. We need to do something with it. This is where analytics comes in. Advanced analytics, including things like predictive modeling, can take that raw claims data and turn it into actionable insights. Instead of just knowing that vendor X had an outage last year, analytics might help us predict the likelihood of another outage in the next six months, or even estimate the potential impact if one occurs. This allows us to refine our risk scores. A vendor that previously looked okay might suddenly show up as higher risk once we apply analytical models to their historical performance and industry data. It’s about getting a more precise picture of the actual risk involved, rather than relying on broad assumptions. This can also help in understanding complex issues like employment practices liability, where data can reveal hidden trends [72c3].

Ensuring Data Accuracy and Completeness

Of course, all this talk about data and analytics is only useful if the data itself is good. Garbage in, garbage out, as they say. We need to make sure the information we’re collecting about our vendors is accurate and complete. This means having clear processes for gathering vendor information, regularly updating it, and validating its accuracy. If a vendor’s financial health report is outdated, or if we’re missing key details about their security protocols, our risk assessment will be flawed. It’s a bit like trying to get a clear picture through a smudged window – you might see something, but you’re not getting the full, sharp image. This focus on data quality is critical for making sound decisions about which vendors to partner with and how to manage the risks they present. Sometimes, even artificial intelligence can help in analyzing large datasets to understand conflicts [4e74].

The effectiveness of any vendor risk management program hinges on the quality and depth of the data it utilizes. Without accurate, complete, and relevant information, risk assessments become unreliable, mitigation strategies may be misdirected, and the organization remains exposed to unforeseen vulnerabilities. Continuous efforts to improve data collection, validation, and analysis are therefore not just operational tasks, but strategic imperatives for maintaining a robust defense against third-party risks.

Navigating Regulatory Considerations

When you’re dealing with vendors, especially those handling sensitive information or critical functions, you can’t just ignore the rules. Laws and regulations are in place to protect consumers, ensure fair practices, and keep systems secure. It’s a big part of managing vendor risk, and frankly, it can get complicated.

Compliance with Data Privacy and Security Laws

This is a huge one. Think about laws like GDPR, CCPA, or HIPAA, depending on where you operate and what kind of data you’re dealing with. These laws dictate how personal information can be collected, stored, processed, and shared. When a vendor handles your customer data, they must comply with these regulations. A data breach at a vendor’s end can easily become your problem, leading to hefty fines and a serious hit to your reputation. You need to know what data is being shared, how it’s protected, and what the vendor’s breach notification procedures are. It’s not just about the vendor’s security; it’s about your compliance too. You are ultimately responsible for the data, even if a third party is handling it.

Understanding Third-Party Oversight Requirements

Regulators often have specific expectations for how companies oversee their third-party relationships. This isn’t just a suggestion; it’s often a requirement. They want to see that you’re not just handing over data or functions and walking away. This means having clear contracts, performing due diligence before onboarding a vendor, and conducting regular reviews. Think of it like this: if you hire a contractor to build an extension on your house, you don’t just give them the keys and hope for the best. You check their work, make sure they’re following building codes, and ensure they’re licensed and insured. Vendor oversight is similar, but with potentially higher stakes. This includes understanding their contractual liability carveback systems and how they manage risk.

Managing Cross-Border Regulatory Complexities

Things get even trickier when your vendors operate in different countries. Each nation has its own set of rules regarding data privacy, security, and business operations. For instance, data transfer rules can be a minefield. You might need specific agreements or certifications in place to legally move data between jurisdictions. Sanctions compliance and anti-money laundering regulations also come into play. It requires a detailed understanding of international laws and often means developing localized compliance strategies. Ignoring these complexities can lead to legal trouble and operational disruptions, making it vital to get this right.

Continuous Monitoring and Improvement

Vendor relationships aren’t static, and neither should your risk assessment be. Think of it like keeping an eye on your investments; you wouldn’t just set it and forget it, right? The same applies to vendor dependency. Things change – vendors might grow, shrink, get acquired, or face new challenges. Your understanding of their risk needs to keep pace.

Regularly Reviewing Vendor Performance

This is where you actually check in on how your vendors are doing. It’s not just about whether they delivered on time last month, but about their overall health and how they’re sticking to the agreements you made. Are they meeting the service levels? Are there any red flags popping up in their operations or financials? This could involve looking at things like:

Service Level Agreement (SLA) adherence: Are they hitting the targets you both agreed on?
Financial stability: Are there any signs of financial distress that could impact their ability to operate?
Security posture: Have there been any recent security incidents or changes in their security practices?
Compliance status: Are they still meeting regulatory and contractual obligations?

It’s about getting a clear picture, not just relying on past assumptions. Sometimes, you might need to look at their scheduling and property updates if they handle physical assets, to make sure everything aligns with your needs.

Updating Risk Scores Based on New Information

Once you’ve gathered performance data, the next logical step is to update those risk scores. If a vendor’s performance has dipped, or if new information comes to light about their financial health or operational stability, their risk score should reflect that. This isn’t about punishment; it’s about accurate risk representation. A vendor that was once low-risk might become moderate or even high-risk if circumstances change. Conversely, a vendor that has made significant improvements in their security or reliability might see their risk score decrease.

The goal here is to maintain a dynamic view of vendor risk, moving away from static assessments that quickly become outdated. This continuous feedback loop is vital for proactive risk management.

Adapting Scoring Models to Evolving Threats

The threat landscape is always shifting. New types of cyber threats emerge, geopolitical events can disrupt supply chains, and regulatory requirements change. Your vendor dependency risk scoring models need to be flexible enough to account for these evolving threats. This might mean incorporating new data points into your scoring, adjusting the weighting of existing factors, or even overhauling the model entirely if a significant new risk category emerges. For instance, if there’s a rise in certain types of supply chain attacks, your model might need to place a higher emphasis on a vendor’s supply chain resilience and their own third-party risk management practices. You might also need to consider how things like firmware vulnerabilities could impact your vendors and, by extension, your own systems. Persistent access concerns are a good example of a threat that might require model adjustments.

This ongoing process of review, update, and adaptation is what keeps your vendor risk management program effective and relevant in a constantly changing business environment.

Integrating Vendor Risk Into Enterprise Strategy

Aligning Vendor Risk with Business Objectives

Thinking about vendor risk shouldn’t be an afterthought; it needs to be woven into the fabric of your company’s overall goals. When you’re setting targets for growth, efficiency, or innovation, consider how your vendor relationships support or potentially hinder those aims. For instance, if a key business objective is to speed up product development, relying too heavily on a single vendor with a history of delays could be a major roadblock. It’s about making sure your vendor strategy actively contributes to what the business is trying to achieve, rather than just being a separate operational task.

Communicating Risk Exposure to Stakeholders

Getting everyone on the same page about vendor risks is key. This means talking about potential problems not just with your direct team, but also with leadership, finance, and even the board. You need to explain what could happen if a critical vendor fails, what the financial impact might be, and what steps are being taken. Presenting this information clearly, perhaps with a simple chart showing high-risk vendors and their potential impact, can make a big difference. It helps everyone understand why certain investments in vendor management are necessary. Think about it like this: if you’re trying to get buy-in for a new security system, you need to show people why it’s needed, not just that it exists. The same applies to vendor risk.

Identify key stakeholders: Who needs to know about vendor risks?
Quantify potential impact: What’s the financial or operational cost if a vendor fails?
Outline mitigation plans: What are we doing to address these risks?
Regular reporting: How often will updates be provided?

Effective communication about vendor dependencies helps ensure that the entire organization understands the potential vulnerabilities and supports the necessary measures to manage them. It moves vendor risk from a technical issue to a strategic business concern.

Fostering a Culture of Risk Awareness

Ultimately, managing vendor risk isn’t just about policies and procedures; it’s about how people think and act within the company. You want to create an environment where employees at all levels consider the risks associated with third-party relationships in their day-to-day work. This could involve training sessions that highlight common pitfalls, encouraging employees to flag potential issues they see with vendors, or making sure that new vendor onboarding includes a clear risk assessment step. When everyone feels a sense of responsibility for managing these risks, the company becomes much more resilient. It’s about building a collective awareness that helps protect the business from unexpected disruptions, much like having good supply chain disruption coverage can provide a financial safety net.

This proactive approach to vendor risk management is a critical part of overall business risk mitigation efforts.

Wrapping Up Vendor Dependency

So, we’ve gone over how to look at vendor dependency. It’s not just about knowing who your vendors are, but really digging into how much you rely on them and what happens if they stumble. Think about it like this: if one of your key suppliers suddenly has a problem, can your business keep going smoothly? Probably not. That’s why scoring this dependency is so important. It helps you see where the weak spots are before they become big issues. By understanding these risks, you can start making smarter choices, maybe finding backup options or working closer with your current vendors to make sure they’re solid. It’s all about keeping your own operations running without a hitch, no matter what’s happening with the companies you depend on.

Frequently Asked Questions

What is vendor dependency risk?

It’s like relying too much on one helper for a big project. If that helper can’t do their job anymore, your project gets stuck. Vendor dependency risk is about how much your business relies on outside companies (vendors) and what happens if they mess up or disappear.

Why is scoring this risk important?

Imagine you have a lot of helpers. Some are super reliable, others not so much. Scoring helps you figure out which helpers are the most important and which ones could cause the biggest problems if they fail. This way, you can focus on keeping the most critical ones happy and prepared.

How do you figure out how risky a vendor is?

You look at two main things: how likely it is that the vendor will have a problem (like going out of business) and how bad it would be for you if they did. It’s like guessing if your friend will forget your birthday and how sad you’d be if they did.

What’s involved in creating a scoring system for vendor risk?

First, you need to know which vendors are super important to your business. Then, you sort them by how much you depend on them. Finally, you think about what would happen if each vendor suddenly stopped working with you – would it be a small hiccup or a major disaster?

How can you make vendor risks less scary?

You can have backup plans! This means having other options if your main vendor can’t deliver. It also involves checking in on your vendors regularly to make sure they’re doing a good job and planning for what to do if something goes wrong.

Why is data important for managing vendor risk?

Data is like clues. By looking at past problems (like when a vendor failed before) and using smart tools, you can get a better idea of future risks. Having accurate and complete information helps you make smarter choices about your vendors.

Are there rules about managing vendor risk?

Yes, especially when it comes to keeping customer information safe and secure. Different countries and industries have rules about how companies must watch over their vendors, especially when sensitive data is involved.

Should you just score vendors once and forget about it?

Nope! Things change all the time. You need to keep an eye on how your vendors are doing, update their risk scores when new information comes up, and adjust your scoring system as new threats appear. It’s an ongoing process.