Learn how to build a defensible vendor risk score using inherent risk, control evidence, residual risk, thresholds, and review workflows.