RiskyProject is consistent in the way that it calculates risk at both the project or program level. Risks that appear in a Program (Summary Project) risk register are there because either they have been assigned to one or more projects in the program or are being managed at the program level. If a risk is being calculated at only the project or program level, the risks scores calculations are fairly simple: impact x probability. For qualitative analysis, this is very straight forward. For quantitative cost and schedule Monte Carlo analysis, the impact is a calculated value and can be affected by how the risk is assigned to project tasks, the complexity of the schedule and other factors. Impact is calculated by measuring how the risk correlates with project cost and schedule values for each iteration. This correlation is then adjusted (normalized) as then final score generated.
At the program level, risk scores depend on the level that the risk is being managed at. If the risk is being managed on a project by project basis, then the risk score takes into account the likelihood that the risk could occur on either of the projects. If the risk is being managed at the program level, then the risk score is calculated qualitatively and only uses the chance and probability as inputs.