Agree that the Entity Upstream and Downstream relationships are set up at the entity level.

The question is more around how risk roll-up.

As you mentioned, if we set upstream and downstream entities, the risk score on each entity is the sum of all risks associated with that entity.

Does the child entity's risk score (not risk itself) roll up to the upstream entity? Or does it have to be built using reporting?