Are there any 'standards' to use for the three categories of Risk when using Appendix J in the FFIEC Exam Manual?
Examiner suggested we update ours, but also said that Low=1, Moderate=2, High=3 isn't enough. Also had no suggestions on how the overall 'score' translates to LOW - MODERATE- HIGH. Any suggestions are welcome.

I tend to lean towards numeric scores. The overall score then is either a simple total, or a weighted total if people on the team are feeling frisky.

We were using the 1-2-3 for the individual categories and three ranges for the overall. Is that what you do, or do you weight the individual factors? If so, what are your ranges for 'Overall Risk' - under 15 is low, 16-25 is moderate, and over 25 is High? Is that reasonable?

Examiner didn't seem to like the 1-2-3 method, especially for the categories which don't apply to us (foreign correspondent accounts, international accounts); can we use 0 for them to eliminate from the overall score and use under 13 is low, 14-23 is moderate, and over 23 is High?

We would score the individual factors. One of the objections to having only 3 buckets (or 3 score values) is that more things turn out to be "moderate" than probably should. If you expanded to 5, or even 7 buckets, you might get a more realistic picture.

I like using 0 to score things that don't exist. Keep in mind that you will still have to explain that ranking since it will stick out.

Thanks for the input!