Google publishes the model. Its help page says "Local results are mainly based on relevance, distance, and popularity." Relevance is how closely a listing fits the search. Distance is how far the business is from the person searching. Prominence "means how well-known a business is," and it adds that "More reviews and positive ratings can help your business’s local ranking."
Distance cannot be bought or edited, which is why a company that works from the same address as a rival can still win one neighborhood and lose the next. That makes local SEO a game of relevance and prominence, and of knowing exactly where your profile shows up. Our guide to winning the map pack walks through the results page itself.