Relative risk score depending on amount of inherent risks and size of each inherent risk

[cercig]

Hello,

I have a set of population with multiple risk factors:
- Every population member can have a combination of 30 different risk factors.
- Every risk factor can have a score from 0 to 10 depending on population members' characteristic.
- So for example,
-Member-1 can have 4 risk factors with risk scores as (8,3,6,4),
- Member-2 can have only 2 risk factors with risk scores (9,10),
- Member-3 can have 6 risk factors with risk scores as (4,3,3,4,3,4)

Question: I want to find an "Overall risk value" for each population member in a scale from 0 to 10 depending on their risk depending on their risk scores and amount of risk scores. So the population member with high risk will be placed close to 10, low risk member will be placed closed to 0. What is the best method for it?

Tricky part: If I compare the aggregated risk score of each population member with each other, then for example Member-2 has aggregated score as (9+10=19), and Member-3 has aggregated score as (4+3+3+4+3+4 = 21).

Even if 21 is greater than 19, the particular risk scores in Member-2 are very high compares to Member-3.

So somehow I want to have a more balanced solution. Both "number of scores" and the "size of the particular risk scores" will matter in the result.

Thanks in advance

 

[hlsmith]

Well you need to find the highest possible score given the presence of every risk factor and that is your max. Next you standardize the individual risk factor scores given the max is rescaled to 10. Not sure what your allegiance to 10 is, but if you have 30 risk factors, making the scale wider is likely a good ideas so you don't have individual risks of say 0.8.

I didn't follow, your second concern.

Also, this seems like you are trying to apply an existing risk score. How or where were these risk scores originally derived? Knowing the sample and modeling process would help ensure you are deviating/generalizing too far from its origins.

 

[cercig]

Well you need to find the highest possible score given the presence of every risk factor and that is your max. Next you standardize the individual risk factor scores given the max is rescaled to 10. Not sure what your allegiance to 10 is, but if you have 30 risk factors, making the scale wider is likely a good ideas so you don't have individual risks of say 0.8.

I didn't follow, your second concern.

Also, this seems like you are trying to apply an existing risk score. How or where were these risk scores originally derived? Knowing the sample and modeling process would help ensure you are deviating/generalizing too far from its origins.

@hlsmith thank you for your answer. How did we populate the data? Maybe you expect an answer like "some statistical reference data", but this problem is related to an area which doesn't have enough data, but it has lots of law, regulation which consists of qualitative rules instead of quantitative rules. So if the question is "How a financial product can be used by criminals", some subject matter experts decide if a financial product is vulnerable in 4 different ways (like my first population member) and what are the vulnerability risk for each of them (like 8, 3, 6, 4).

So I can not change the input data. I just need to sort each product in a scale from 0 to 10.

So what did I mean with "Tricky part" in my question? Like you said, I can first calculate the aggregated score and then compare them with the absolute maximum score. However, my 2nd product has 2 risk factors with very high vulnerability scores (9+10=19 as total). If the 3rd product with 6 medium/low level vulnerabilities have total score as (4+3+3+4+3+4 = 21), can I say that the 3rd product is more risky than the 2nd product?

So my confusion is that I know that 9 and 10 points in the 2nd product are very high serious vulnerabilities according to the qualitative sources (like regulations), but the aggregated data says that the 3rd product is more risky even if each vulnerabilities are not so high.

I hope I could explain my confusion

 

[hlsmith]

Yup, I follow what you are writing. 3nd is more risky, yes (mathematically) - but if you are trying to intervene to prevent an outcome targeting certain components would have a higher potential ROI. Is this something you are contemplating?