Skip to content

Prism

Risk scoring

Tier: Judge · Requirement module: Risk Engine · Status: ✅ Prototyped

Purpose

A prism splits light into its components. Prism scores firms for risk-based supervision and always shows the decomposition: a score is never a bare number, it is a set of weighted named drivers each traceable to the submission, breach, or finding that produced it.

This makes the tenth law true, and it is the difference between a supervisory position and an opinion.

Scope

Capability Status Notes
Firm inherent risk 🟡 Licence category, size, client money held, product complexity
Control effectiveness ⬜ Governance and audit findings, compliance officer stability
Compliance history ✅ Late filings, rejections, open breaches
Return analytics ✅ Ratio deterioration, variance above tolerance
AML/CFT indicators ⬜ PEP exposure, STR volumes, sanctions screening gaps (R07–R10)
Market conduct metrics ⬜ Complaint volumes and resolution times (R18)
Capital adequacy alerts ✅ Early warning ratio breaches, deficits
Risk rating override 🟡 Supervisor override with mandatory reason; never deletes the computed score
Band thresholds ✅ Low / Moderate / Elevated / High, configurable

Score shape

The breakdown is stored, not recomputed at read time. A score displayed in a report a year from now must show the drivers and weights that produced it then.

{
  "firmId": "873390",
  "score": 96,
  "band": "HIGH",
  "modelVersion": "1.0",
  "computedAt": "2026-08-11T09:44:00Z",
  "drivers": [
    { "code": "DEADLINE_LAPSED",   "weight": 25, "contribution": 25, "source": "OBL-873390-R02-2026Q2" },
    { "code": "BREACHES_REPORTED", "weight": 20, "contribution": 20, "source": "sub:v1.0/R02-F08", "detail": "6 breaches" },
    { "code": "EWR_BELOW_FLOOR",   "weight": 22, "contribution": 22, "source": "assay:V07" },
    { "code": "VARIANCE_TOLERANCE","weight": 15, "contribution": 15, "source": "assay:V04" },
    { "code": "NO_REVIEWER",       "weight": 8,  "contribution": 8,  "source": "bench:unassigned" }
  ],
  "override": null
}

Every driver names its source. A supervisor clicking a driver lands on the thing that caused it — the obligation, the field, the validation result, or the queue state.

Bands

Band Score Supervisory meaning
Low 0–39 Routine monitoring
Moderate 40–59 Standard review cycle
Elevated 60–79 Enhanced scrutiny, thematic inclusion
High 80–100 Priority review, inspection candidate, escalation likely

Thresholds are Return Studio configuration. A supervisor recalibrating bands does not need a release.

Overrides

A supervisor may override a rating. The rules:

  • The computed score is never deleted or altered; the override sits beside it
  • An override requires a reason and is sealed
  • The UI shows both, so a reader always knows a human intervened and why
  • Overrides expire at the next scoring cycle unless renewed, so they cannot silently persist

Owns

  • Scores, bands, and driver breakdowns
  • Model versions and weights in force at computation time
  • Overrides and their reasons
  • Scoring history per firm

Does not own

Open questions

  • Scoring cadence. Event-driven on every submission, nightly, or both? Event-driven risks a score that moves while a reviewer is looking at it; nightly risks acting on stale information. Likely event-driven with the score's computedAt shown wherever it appears.
  • Model change and comparability. A weight change makes today's scores incomparable with last quarter's. Model version is stored, but trend charts crossing a version boundary need to say so rather than draw a misleading line.
  • Inherent versus residual risk. The requirement asks for both inherent risk and control effectiveness. Whether the platform publishes one blended score or two is a supervisory decision with real consequences for how firms are compared.
  • Assay — the largest source of drivers
  • Bench — raises risk flags
  • Projections — sector heatmaps built from scores