Is the Risk Rating on the vendor record is supposed to be automatically updated when a Vendor Risk Assessment has been completed - and if so, at which stage and by which logical components?

The Risk Rating on the Vendor field is set Manually

The Risk Rating on the vendor table isn't dependent on any type of assessment result. Not from the tiering assessment, repeating assessment, or regular assessment. 

The reason behind that is because there might be multiple assessments being performed as part of the vendor risk management process - perhaps one to measure reputation risk, one to measure financial viability, and another to determine their operational capacity - which means that the logic to define the risk rating from an assessment is too complex as to simply just inherit it from the last completed assessment. 

In other words, it is set manually.