I have been GMing for about 20 years (I know, not a lot of experience compared to some), starting with AD&D 2nd Ed, then WOD, SR2, SR3, D&D 3.5, Pathfinder and now SR4. This is what I do for challenge ratings, starting with individuals
First, I use the Karma Build System for both PCs and NPCs in SR4. The reasoning for this is that you can reverse engineer a character's stats and get a definitive Karma amount.
Disclaimer #1: It is entirely possible to spend lots of Karma on non-combat related skills, equipment, etc and Karma is not an exclusive challenge rating indicator, only an experience indicator.
Second, when building a NPC, I look at the average Karma for the party, including the amount that they started with. For the game I am currently running now, which is low-powered, that is starting of 650 + 15 karma so far, so 665 karma. This number is comparable, not equal, to the average experience the NPC has.
To give a better example, using this idea, I also have a scale of Karma to lifespan
Birth to Childhood: 0 - 150
Childhood to Adolescence: 150 - 250
Adolescence to Early Adult: 250 - 350 (350 is the Karma for the Average Joe)
Mildly Experienced Adult (Rookie Cop, Ganger, etc): 450
Experience Adult (Cop, Ganger Lt., etc): 550-750
Very Experienced Adult (Veteran, Gang Leader, etc): 750-950
EXTREMELY Experienced Adult: 950+
Once the Karma amount is determined, usually half goes into attributes, about 10% to cash, and the remaining divided among skills, qualities and contacts. The availability of equipment I limit the build to is 1 / 33.3 Karma over 350 (so 750 Karma = Availability: 12, 750-350 = 400 / 33.3 = 12)
Disclaimer #2: When building NPCs this way, it is vitally important that you build them as detailed as characters. That includes lifestyles, clothing, the Made Man quality for Mafia/Yakuza, etc. This does make it time consuming. As such, I try to build different attribute/race builds and then different quality/skill/special attribute/General Contacts (Street Contact #1, Corp Contact #3, etc) and gear builds, then mix and match them kinda like Packs
When doing the actual building, some of the common things to keep in mind for combat effectiveness are:
Attributes:
Agility & Reaction (as most combat is ranged)
Body & Willpower (for damage tracks)
The other attributes only come up when the concept requires it, but otherwise, I try to keep at Racial average
Skills:
Dodge (a must!!)
Perception (another must!!)
Etiquette (at least a little)
Unarmed Combat (or the Close Combat Group as appropriate)
Pistols (or the Firearms Group or other ranged attack skill as appropriate)
Their primary language (which instead of Native, I house-rule it Rating 4 for free)
At least one other language
At least 3 Knowledge skills appropriate to their career (sometimes it's just Professional Skill 1,2 & 3)
Disclaimer #3: When using qualities like School of Hard Knocks or College Education, I apply the rank modifier after the normal skill is purchased with Karma. And don't be afraid of Specializations. I use them ALL the time.
Gear:
Lifestyle (at least 1 month, but no more than 3 months, unless the build actually owns a lifestyle)
Armor (limited by Body and as appropriate to the build. Average Joes rarely wear armor... the fools)
Commlink (this is usually accompanied with the Basic+ Program package, AR gloves and Glasses or Contact Lens with Image Link and often Smartlink, Earbud (with no options), and the Encrypt Program)
A vehicle of some kind
An appropriate weapon (which is often the Ares Predator IV with 2 clips of Regular Ammo)
Magic / Resonance:
For spellcasters, a number of spells at least equal to their Spellcasting/Ritual Sorcery skill, but rarely more than 3x that.
For adepts, I house-rule the 20 Karma per Power Point, so it's rare to have a Magic of 5+, but rarely more than 1.5x Magic in Power Points
Technomancers: 10% of the Karma total in Complex Forms
Initiation / Submersion / Foci: ONLY if the build requires it
Contacts:
At least 3, the first with Loyalty of 3+ (the significant other, family member, best friend, etc) and two others at Loyalty 1-2. For no man is an island. Social builds (like most contacts) have 10-20 contacts but listed as 10 Street Contacts (C: 1 / L: 1), 5 Corp Contacts (C: 2 / L: 1), etc.
Once the character is built, I go back through and determine all the appropriate dice pools.
Somethings to watch for when totaling dice pools:
Attack dice pools (Don't forget Smartlink, hence Ares Predator IV... damn cheap for Smartlink)
Reaction (and the best combinations for Block / Parry / Dodge for melee)
DV values for their weapons (and Resist Dice Pool Types, i.e. Body + Ballistic, Body + Impact or half, Body alone, Willpower alone, etc)
Damage Compensation and/or Recoil Compensation
Infiltration & Perception dice pools (same for Analyze, Scan Encrypt and Stealth Commlink Pools)
Damage Tracks
Some of the things I have noticed is...
If the build is melee based, make sure to give them a good Running skill to sprint across the room (either to charge or get to cover).
If the build isn't good with the Matrix and does not need it, consider multiple disposable commlinks (but this makes Smartlink difficult) or a mook agent (kinda rare / expensive)
If the build ends up with more than 1 physical Initiative Pass, and they are not combat monsters, keep 1 IP reserved for a Full Defense
Once you have the build, with all of the dice pools, compare it the PC that closely matches the build (hacker vs. hacker, rigger vs. rigger, street sam vs. street sam). If the build has less dice in the important dice pools, it is good for a disposable goon. If it's about 50/50, then a legitimate threat. If the build beats the PC is every dice pool, then it's going to be one hell of a fight.
Now for the final disclaimer...
This method takes a lot of work... a whole lot of work... probably more than most are willing to spend. While I personally prefer a sense of completeness (makes even the most cookie-cutter goon seem more organic), don't be afraid to leave a number of parts open and use the same template for many different types of NPCs.
After all, what real difference between a Rusty Stiletto Ork and a Scatterbrain Ork isn't going to be covered with Personal Interest 1 & 2 and a splash of paint? Or Knight Errant Human vs. Competent Security Guard Human with Police Procedures vs. Security Procedures?
Typically the goons I create are around 500 karma, with street lieutenants around 550-600 and real threats around equal to the party average.
Lastly, this method works well with metahumans and other playable options from the RC. When it comes to animals & spirits, I reverse engineer the build back to Karma to see where it stands, but the critter powers and weaknesses do not translate over well. The best I have found so far is trying to mimic the powers as adept powers, but it's not seemless (however, Sapience, or lack thereof, doesn't come up as much as you might think... after all, if you're not using hell hounds to attack / harass the party, what else are they there for.)
I hope that helps...
