Risk tier assignment at intake

Legal teams lose hours on requests that look urgent in email but are routine on paper, and on the reverse: low-priority tickets that carry hidden exposure. Risk tier assignment at intake applies a model at submission time so the first human view is already ranked by structured signals, not subject line tone or who sent the Slack ping.

The goal is quality at the front door. A tier is not a routing shortcut around legal; it is a consistent read on value, counterparty, and jurisdiction so reviewers spend attention where mismatch cost is highest. When any input is absent, the tier leaves that slot empty rather than guessing, and legal still opens every request before work proceeds.

Most contract intake still mixes unstructured fields (free-text purpose, attachment names, CC lists) with a few required dropdowns. Reviewers reconstruct context manually: Is this vendor already approved? Does the amount trigger board approval? Does the governing law sit in a monitored list?

Scoring at intake collapses that first-pass reconstruction into a single tier field backed by cited inputs. Contract request triage describes the broader workflow; tier assignment is the quality layer that names why a request landed where it did.

Teams that only use auto-priority scoring by SLA or requester seniority often mis-rank deals. A small-dollar order with a sanctioned-adjacent counterparty or a novel jurisdiction can be more consequential than a large renewal with a known partner. Combining value, counterparty, and jurisdiction in one model reduces those inversions before counsel assigns staff.

Three inputs drive the tier. Each appears explicitly on the intake record so reviewers can confirm or override with context the model did not see.

Deal value. The model maps amount (and currency, when normalized) to internal bands aligned with approval policy: thresholds for manager sign-off, legal-only review, executive involvement, or external counsel. Value alone never sets the final tier; it anchors severity when other flags are quiet.

Counterparty risk. Counterparty identity is matched against firmographic and compliance data. Dun & Bradstreet supplies business verification, financial stress indicators, and hierarchy linkage so "Acme LLC" is not confused with a similarly named entity. Refinitiv (World-Check and related datasets) supports sanctions, PEP, and adverse-media style screening where policy requires it. The tier cites a counterparty risk flag (clear, elevated, or restricted per your taxonomy), not a opaque score, so legal can see what triggered elevation.

Jurisdiction. Governing law, place of performance, and data residency hints feed a jurisdiction risk flag. Some teams maintain an allow list (home country plus standard commercial hubs), a watch list ( emerging regulatory change, unfamiliar dispute forums), and a restricted list (export control, blocking statutes, or non-negotiable policy exclusions). The model assigns jurisdiction contribution to the tier from that matrix, not from geolocation of the submitter.

Where intake forms capture only one of these (value in the ERP hook but counterparty as free text), enrichment jobs backfill before tiering when identifiers exist; otherwise the corresponding tier line stays empty.

Architectures vary, but a practical pattern is a rules-plus-ML stack: hard stops (sanctions hit, restricted jurisdiction) cap the tier regardless of value; a gradient model or weighted table combines the remaining signals into Low, Medium, High, or Critical labels your team defines.

The displayed tier is always accompanied by citations:

• Value: band and raw amount (e.g., "Band 3 — USD 420,000")
• Counterparty: flag and match confidence (e.g., "Elevated — D&B linkage 0.91, Refinitiv review queue")
• Jurisdiction: flag and rule id (e.g., "Watch — governing law SG, policy rule JUR-12")

If deal value was not provided, the value line is blank. Same for counterparty when no confident match exists, or jurisdiction when governing law is missing. The overall tier may still compute from available fields, or show "Incomplete — legal to classify" depending on policy; either way, empty slots signal what intake must fix next time, not silent defaults.

This transparency matters for audit. When someone asks why a request jumped the queue, the answer is in the tier card, not in model weights legal never sees.

Triage usually lives in a CLM or service portal. Ironclad and similar CLMs can run tier logic on workflow start: webhook from the intake form, enrichment call-out, tier write-back to the request object, then queue rules send High/Critical to senior reviewers or parallel compliance.

ServiceNow Legal Service Delivery is a common entry point when business users file "need a contract" tasks. A mid-tier integration pattern stores tier and citations on the task record, uses flow designer for hard-stop routing, and syncs to CLM when a matter converts to a draft. Keeping tier assignment in the system of entry avoids re-keying and preserves timestamps for metrics.

Downstream, tier at intake complements clause risk classification on the draft document. Intake tier answers "should we worry before we read?"; clause models answer "what in the text triggers playbooks?" Both feed quality, at different lifecycle moments. Teams should not double-count the same risk (jurisdiction flagged at intake and again in boilerplate) without clear precedence rules.

Automated tier assignment does not approve contracts, select templates, or waive policy. Legal still validates business facts the model cannot know: oral side deals, relationship exceptions, pending litigation, or a counterparty mid-acquisition. Reviewers treat the tier as a prioritized hypothesis; they confirm citations, fill gaps, and re-tier manually when needed.

Operational norms that preserve quality:

• No auto-decline on tier alone. Restricted counterparty or jurisdiction flags route to compliance or senior counsel, not auto-rejection, unless policy explicitly allows hard stops.
• Override with reason. When legal disagrees with the tier, the override reason is logged for model and rules tuning.
• Feedback loop. Monthly samples of overrides improve bands, jurisdiction lists, and match thresholds for D&B and Refinitiv queries.

Empty fields are a feature, not a failure. They mark incomplete intake and train requesters to supply governing law and legal entity early, which improves every later step including clause review.

Track leading indicators tied to outcome quality, not just speed:

• Percentage of requests with all three citations populated within 24 hours of submit
• Override rate by tier (High override on Low tiers suggests model drift; Low override on High tiers suggests good calibration)
• Time to first qualified legal touch on Critical vs Low (should separate without starving Low entirely)
• Rework rate: requests that change tier after initial assignment due to missing data at intake

Pair these with auto-priority scoring metrics only where SLA and risk tier align; when they diverge, policy should state whether risk or SLA wins for queue ordering.

Risk tier assignment at intake turns scattered intake fields into a cited, review-ready classification. Value, counterparty, and jurisdiction each earn a line on the record; gaps stay visible; Ironclad, Dun & Bradstreet, Refinitiv, and ServiceNow are typical anchors in the stack. Legal keeps judgment on every file, but spends it where the tier, and its citations, say the exposure actually lives.