An important point for my proposal is that we only track scores for individual humans, not aggregate entities. I think this makes a difference in a lot of ways.

A new company can (should!) hire some people with solid local experience, so can have a score (we still need defaulting rules for individuals, of course).

Individuals risk reputational damage if people elsewhere in the project behave badly, which should increase cooperation with controls. Similarly, well managed companies will find it easier to hire, while poorly managed companies will find it more difficult.

Companies that have a lot of poorly scored individuals because of poor historical practice will be extra motivated to bring on people with a history of working on well managed projects, which would help knowledge flow about how to keep projects well managed.