Embodiments of the invention are directed to systems and methods for determining risk associated with a business. The risk determination calculates risk with one or more policy controls associated with one or more business objects in a business object tree. Risk calculated for the policy controls is rolled-up to a business object using an algorithm that does not dilute the risk associated with the policy controls. Likewise, the risk for a business object is rolled-up to the parents of the business object. Risk is finally rolled-up to a highest order business object, which represents the risk associated with the business.