How a 100-point ITC risk score should be built — and how to read one

A vendor risk score exists to answer one question quickly: which of my suppliers should I look at first this month? Everything else about the model — the arithmetic, the weighting, the presentation — is subordinate to that. A score that is accurate but unexplainable will not be used, and a score that is explainable but never changes will not be trusted.

What belongs in the model

For GST vendor risk specifically, the signal set is narrower than people expect. Five families cover it.

Registration status (dominant weight). Active, suspended, cancelled, cancelled with retrospective effect, or provisional. Nothing else in the model should be able to outweigh a cancellation. If a clean filing history can pull a cancelled registration into a medium band, the model is broken.

Filing compliance. Missed returns, consecutive misses, and the GSTR-1 versus GSTR-3B divergence discussed elsewhere in this series. Weighted heavily, but always below registration.

Filing cadence and drift. Chronic lateness that has not yet become non-filing. This is the leading indicator and deserves real weight even though nothing has technically gone wrong.

Profile stability. Changes to principal place of business, additional places, promoter or authorised signatory details, and constitution. Individually innocuous, meaningful in clusters, and a legitimate reason to look closer.

Vintage and scale. Registration age and taxpayer type. These are context, not risk. They should modulate the score modestly and never drive it.

Weighting, plainly

A defensible starting distribution for a 100-point model:

• Registration status: 35 points
• Filing compliance (misses and gaps): 30 points
• Cadence and drift: 15 points
• Profile change events: 12 points
• Vintage and taxpayer profile: 8 points

The numbers are arguable. What is not arguable is the ordering. If a model's ordering does not survive being stated in a sentence — "a suspended vendor scores worse than a chronically late one, which scores worse than one that recently changed its address" — the model will produce results that finance teams override, and an overridden score is dead weight.

Bands must map to actions

Scores are consumed as bands, not as numbers. Three bands are usually enough, and each needs a defined action:

• Low risk: proceed normally. Reconfirm at the next quarterly review.
• Medium risk: claim credit only where reflected in 2B, and require category-owner sign-off for new purchase orders above a threshold.
• High risk: hold the tax component, freeze new procurement, and require written explanation before resuming.

If two bands share an action, you have one band with a decorative split.

The reasons list is not optional

Every score must be delivered with the two or three signals that moved it most. "61 — two consecutive late GSTR-3B filings, principal place of business changed last month" is actionable. "61" is not. This single design decision determines whether a risk model becomes part of the monthly routine or an artefact that finance politely ignores.

Three traps

Stale inputs. A score computed on data refreshed quarterly is a quarterly score, whatever the dashboard implies. Refresh cadence should be stated next to the number.

Over-modelling. Adding a dozen weak signals with small weights makes the score smoother and less explainable. Resist. Fewer, stronger signals produce better decisions.

Score chasing. Once a score exists, someone will ask suppliers to improve it. That is fine only if the underlying behaviour improves. Guard against cosmetic fixes — a single on-time filing after six late ones should barely move the number, which means the model needs memory, not just a current-state read.

Reading someone else's score

If you are evaluating a vendor risk product rather than building one, ask four questions: what are the inputs, how often are they refreshed, what are the weights, and does the output tell me why. A provider that cannot answer all four is asking you to accept a number on faith, and a number accepted on faith is not a control.

Indicative GST compliance and ITC risk information based on GSTN-reported data. Not a government portal, credit rating, legal opinion, professional advice or guarantee of ITC availability.