On the ePO - On-prem console, reputation information for a file is received from various sources, then collated to compute reputation. Application Control uses values and parameters provided by these sources to determine final reputation for files and certificates.
Here is how final reputation is computed for an unsigned file. 
Here is how final reputation is computed for a signed file. 