DeFi Risk Management: A Scoring Template for Risk Committees

By Owen ThurmPublished November 10, 202611 min read

Quick answer. Score the engagement, not the protocol name. This template rates eight weighted dimensions on a 0 to 4 residual-risk scale and keeps evidence confidence separate. Then apply hard gates that no total can override, and record limits, the committee decision and a review cadence.

Watch: DeFi Risk Management: A Scoring Template for Risk Committees 1:40

Video transcript

Risk committees approve positions, not protocols. So score the engagement, not the protocol name.

ADGM's draft DeFi guidance, open for comment until November 30, says assess risk by activity, dependency and exposure, not as one composite.

The template weights eight dimensions to one hundred points, led by contracts and integration at twenty. Treat the weights as a starting point for calibration.

Each dimension scores zero to four, higher is worse. Zero is never risk-free, one is minor, two is material, three needs senior review, four is unacceptable.

Use the highest material scenario score in each dimension, since averages hide serious weaknesses. Blank scores never default to zero, and missing critical evidence blocks approval.

Totals run from zero to four hundred. Below one hundred gets ordinary review, two hundred or more blocks new exposure, and any single four blocks approval.

In a fictional example, raising governance to four lifts the total to one hundred ninety five. That is below two hundred, yet the gate still blocks approval.

Set limits beside the score, then match review to risk speed: full scoring before approval, continuous onchain alerts, daily reconciliation, and reassessment after trigger events.

Guardian's Digital Asset Assurance Pilot can supply evidence for the technical dimensions. Read the full template, or talk to Guardian about scoping your actual integration.

Why Scoring Matters

A risk committee rarely approves a protocol in the abstract. It approves a position: one entity, one market, one size and one exit plan.

Weighted institutional frameworks already exist. Galaxy published one on August 7, 2025, with six weighted domains and a set of minimum viable criteria. Galaxy

Galaxy rates the relative risk between protocols, not absolute risk, and limits it to the operational risks of interacting with a protocol.

ADGM's Financial Services Regulatory Authority issued draft DeFi risk management guidance for consultation on October 6, 2026. ADGM Financial Services Regulatory Authority

The draft says risk should be assessed by activity, dependency and exposure, not as one composite. A headline score cannot replace that work.

This template turns diligence evidence into a decision. To gather that evidence first, use our DeFi protocol due diligence checklist.

Risk Dimensions and Weights

Define the engagement before scoring: legal entity, activity, chain, market or vault, asset pair, deployed contracts, position size, leverage and exit horizon.

NIST SP 800-30 Rev. 1 lets each organization define its own scales and combination rules. It prescribes no universal weighting. National Institute of Standards and Technology

The weights below are a Guardian starting point for calibration, totaling 100. They are not empirically validated coefficients.

EEA's DeFi Risk Assessment Guidelines, still listed as current v1, recommend evidence spanning software, governance, custody, economics, legal matters, accounting and counterparties. Enterprise Ethereum Alliance

Score the exact deployed code and integration. EEA says an existing audit should itself be evaluated, not treated as proof of security.

Score how a control behaves under stress, not whether it exists. Guardian's public RAAC Core Contracts report shows why. Guardian

Its resolved Medium finding M-01 found that pause behavior could block liquidation settlement. The report had no Critical or High findings, so a clean severity profile alone earns no points.

Legal permissibility is a gate before scoring. The ADGM draft says due diligence, risk mitigation or ongoing control cannot make an impermissible engagement permissible. ADGM Financial Services Regulatory Authority

Dimension	Weight	Score 0 means	Score 4 means
Contracts and integration	20	Deployed build reviewed, remediation verified	Unresolved material fund-loss path
Governance and privileged authority	15	Authority verified, safeguards tested	Unacceptable unilateral control of assets
Oracle and valuation	10	Fit-for-purpose pricing, failure handling tested	Stale or erroneous valuation beyond tolerance
Collateral, leverage, loss allocation	15	Stress within appetite, loss allocation clear	Stress breaches appetite
Liquidity and exit	15	Exit within approved time and cost under stress	Cannot meet a mandatory liquidity obligation
Chain, bridge and shared dependencies	10	Failure paths mapped, impacts bounded	Unacceptable shared single point of failure
Institutional operations and response	10	Signing, reconciliation, monitoring, response tested	Cannot control or reconstruct transactions
Legal, conduct, financial crime	5	Permission gate passed, obligations evidenced	Unacceptable residual conduct or financial-crime risk

How the DeFi Risk Score Works

Score each dimension from 0 to 4, where higher is worse. NIST permits semi-quantitative scales like this, defined by the organization. National Institute of Standards and Technology

For each scenario, record the likelihood rationale, impact, existing controls and residual risk. NIST also asks assessors to make uncertainty explicit.

Use the highest material scenario score in each dimension. An average lets one serious weakness disappear.

The weighted total is the sum of each weight times its score. With 100 weight points, totals run from 0 to 400.

In a spreadsheet, put weights in B2:B9 and scores in C2:C9, then use =IF(OR(COUNT(C2:C9)<>8,SUM(B2:B9)<>100),NA(),SUMPRODUCT(B2:B9,C2:C9)).

Any blank score or wrong weight total returns #N/A, which means not rated.

Restrict scores to integers 0 through 4. A blank or stale score must never default to zero.

Record evidence confidence separately: verified, corroborated, self-reported or unavailable. Missing decision-critical evidence blocks approval instead of improving the total.

A May 2026 arXiv preprint on institutional DeFi risk also separates evidence reliability from severity. Its authors say their work is illustrative, not predictively validated. Eva Oberholzer and Valeriy Zamaraiev via arXiv

0: demonstrated controls with minimal residual concern within scope. Never risk-free.
1: minor, bounded concerns.
2: material residual concern needing explicit controls or limits.
3: major weakness needing senior exception review.
4: unacceptable exposure under the institution's policy.

Thresholds and Limits

In this template, a total below 100 goes to ordinary committee review. From 100 to below 200 needs enhanced review and explicit conditions.

At 200 or more, new exposure is blocked pending remediation or a formally authorized policy exception.

Any dimension scored 3 escalates whatever the total. Any dimension scored 4 blocks approval.

A fictional example: weights 20, 15, 10, 15, 15, 10, 10 and 5, scored 1, 1, 2, 1, 3, 2, 1 and 1, total 150 points.

That routes to enhanced review, and liquidity at 3 escalates on its own. Raise governance from 1 to 4 and the total reaches 195.

That is still below 200, yet the governance gate blocks approval. The total alone cannot decide.

Set limits beside the score: maximum exposure, gross borrowing or leverage, stressed exit amount, maximum slippage and minimum collateral buffer.

Add shared limits by asset issuer, oracle, bridge, chain and custodian. Give each a unit, data source, warning level, breach level, owner and action.

ADGM's draft proposes sizing and concentration controls before exposure. These are proposed supervisory expectations, not mandatory scoring thresholds. ADGM Financial Services Regulatory Authority

Protocol caps are not institutional limits. Morpho Vault V2 caps by risk identifier constrain allocations only, so exposure can drift above a cap without a new allocation. Morpho

Protocol conditions are not safety buffers. Aave V3 withdrawals need unborrowed liquidity, and an active borrower's health factor must stay at least 1 afterward. Aave

Set your collateral buffer well above that protocol minimum, at a level the committee documents.

Gate: prohibited activity or missing permission fails before any scoring.
Gate: inability to safeguard client assets as required.
Gate: missing evidence essential to the decision.

Committee Reporting

ADGM's draft proposes management information tailored to the decision being made. A single number rarely meets that test. ADGM Financial Services Regulatory Authority

Report the score vector, gate results and evidence confidence beside the total. Build the workbook in these tabs so any decision can be reproduced.

Require independent second-line challenge, and record how assessor disagreements were resolved.

Run a sensitivity test that shifts weight toward the engagement's dominant risk. If a modest shift reverses the decision, report it as model-sensitive.

Scope: entity, activity, chain, market, contracts, size, leverage and exit horizon.
Evidence: dimension, risk, control, test result, confidence, URL, version, chain and block, date, owner, expiry.
Scenario register: likelihood rationale, impact, controls and residual score for each scenario.
Scores and gates: score vector, weighted total, and each gate result as its own field.
Limits and dependencies: each limit with unit, source, warning level, breach level, owner and action.
Committee decision: requested action, current versus proposed exposure, conditions, approver, dissent, exception expiry, next review.
Change log: model version, weight changes and reassessment triggers.

Review Cadence

Match cadence to how fast each risk moves. ADGM's draft proposes monitoring that does not rely solely on periodic review. ADGM Financial Services Regulatory Authority

Galaxy's curation documentation describes stress-testing liquidation incentives, market depth and lending parameters, then monitoring utilization and idle liquidity after deployment. Galaxy

When material evidence expires, freeze new commitments until an authorized reviewer resolves the gap.

Track incidents, near misses, limit breaches and missed changes to refine the rubric. An absence of losses does not validate it.

For what to watch between reviews, see our guide to DeFi protocol monitoring under ADGM's draft.

When	Action
Before approval or any increase	Full scoring against current evidence
Continuous	Alerts on material onchain changes
Daily	Position and limit reconciliation
Monthly	Exception review and evidence expiry check
Quarterly	Committee refresh of scores and weights
On a trigger event	Reassess after upgrades, signer or oracle changes, new collateral, incidents

Frequently Asked Questions

Is ADGM's DeFi risk management guidance final?

No. As checked November 10, 2026, it is a consultation draft with comments due November 30, 2026. The FSRA then considers responses before finalizing, and the paper does not create a licensing framework for protocols. ADGM Financial Services Regulatory Authority, Pinsent Masons Out-Law

Can a committee reuse Galaxy's published weights?

As a reference, yes. Galaxy weights Security and Protocol at 20% each, and Compliance, Financial, Technology and Operations at 15% each. It says weights should be tailored to the investor's capabilities and risk profile. Galaxy

Can public audit findings set default probabilities?

No. Public findings are selected, scope-limited observations. Their count or severity cannot give default probabilities, expected losses or justified position limits. Use them as evidence of how specific controls behave.

Who owns the legal and conduct dimension?

Qualified legal and compliance reviewers. Permissibility, AML and sanctions decisions stay with them, and a technical score does not establish regulatory capital treatment.

Sources

Evidence for the Technical Dimensions

Guardian's Digital Asset Assurance Pilot assesses custody, privileged controls, dependencies and operating arrangements, with optional contract audits and offchain pentests. Scope it to your actual integration.

Talk to Guardian Explore the service