I normally do not assign a level of risk just off of a diagnosis, but rather look for the level of risk that the provider has documented as relates to the patient's current condition and the decision-making that they are performing at that encounter. The reference from the CMS guidelines that I often cite for coders states is as follows:
Because the determination of risk is complex and not readily quantifiable, the table includes common clinical examples rather than absolute measures of risk. The assessment of risk of the presenting problem(s) is based on the risk related to the disease process anticipated between the present encounter and the next one. The assessment of risk of selecting diagnostic procedures and management options is based on the risk during and immediately following any procedures or treatment. The highest level of risk in any one category (presenting problem(s), diagnostic procedure(s), or management options) determines the overall risk.
This suggests two things to me - first, that risk is not something that kind be easily assigned according to a formula, and requires a clinical judgment. As such, this an assessment that is up to the provider to make and should be reflected in their documentation. And second, that risk as related to MDM, is not just about the risk of a diagnosis, but rather is about how the risk increases the difficulty of the provider's work based on how it impacts the different treatment options that the provider has to consider and manage in the course of the encounter. Rather than just assigning a risk based on a diagnosis, a coder or auditor should consider the provider's assessment of the patient, the types of treatments or tests the provider is considering, what possible outcomes or negative side effects the provider has to consider as part of their planning, whether the provider is actively managing a condition or if it is just a co-morbidity that has to be taken into consideration, etc.
Regarding your specific scenario, while you're correct that sepsis can be life-threatening, if the patient has been discharged and the condition has presumably been resolved, then the risk "related to the disease process anticipated between the present encounter and the next one" may not be that high. At the same time, the status of the patient could also be quite complex and may indeed support a high level of MDM. It is really important to consider each encounter note on its own merits and choose a code accordingly, and not rely on a formula for selecting a level based on a general scenario. Just my thoughts.