Hi chrisflynn, the way the calculation works is not straight forward at first.
There are two levels of Risk Management for a project in CA PPM:
1. The qualitative risk scoring of a project at a "macro" level. This is always against the categories, and for v13.3 it is limited to ratings of "High", "Medium", "Low" (to my knowledge it is not until you upgrade to 15.4.1 that you are able to configure additional levels - but you would have to check the release notes).
2. The detailed risk register for the project - where you register individual risks against a the project and categorise them appropriately. The risk categories always line up to the ones that appear on the Project => Properties => Risk Rating subpage.
You can do the qualitative scoring as highlighted in point 1 against a category only up to the point where an individual risk is registered (as in point 2) where at that point the scoring is informed from the bottom up of all the risks that are open against that category.
It means for you to user the overall score (which is calculated against all categories) you need to do a combination of level 1 and 2 for the calculated score to be effective and light up. Most companies have risk practices at various levels of maturity around level 2, but what I have seen previously is that level 1 is a foreign process for my previous companies - even though it is powerful.