🏆 Neotas Named Chartis FCC50 Market Disruptor Winner – Know Your Third Party & Supply Chain Excellence Award Read More →

🏆 Chartis Best-of-Breed Winner 2026 – Adverse Media Monitoring

Vendor Risk Assessment Template

In this guide

What is a Vendor Risk Assessment? Template Components Scoring Framework ★ 50-Question Questionnaire Excel / XLS Template VRA Policy VRA Process NIST Alignment Cyber VRA 5 Template Mistakes ⚠ FAQs

Quick answer

It covers financial stability, cybersecurity posture, regulatory compliance, operational resilience, and ESG conduct in one scored document. The output is a risk score, a risk tier (Critical, High, Medium, or Standard), and an evidence log that serves as an audit trail under DORA Article 28, FCA PS7/23, and OCC Bulletin 2013-29.

Key Takeaways

A vendor risk assessment template produces three outputs: a risk score, a risk tier, and an evidence log. Without all three, it is not audit-ready under any major regulatory framework.
Category weights must be documented at policy level, not left to assessor discretion. Unweighted templates produce scores that are not reproducible across assessors or over time.
Self-reported questionnaire answers without independent evidence validation cap at a score of 3 out of 5 for Critical and High tier vendors. Independent screening is required to score 5.
DORA Article 28 requires continuous monitoring for critical ICT providers, not annual assessment alone. The template must specify the monitoring cadence alongside the assessment criteria.
Exit strategies for Critical vendors are required under DORA Article 28(7), OCC Bulletin 2013-29, and FCA PS7/23. The policy must mandate that no vendor reaches Critical tier without a documented exit plan.
A questionnaire-only programme is a disclosure capture exercise. Independent OSINT screening is the control that converts vendor-reported answers into verified findings.

What Is a Vendor Risk Assessment?

A vendor risk assessment evaluates the risks a specific vendor or supplier introduces to your organisation across financial, operational, cybersecurity, compliance, and reputational dimensions. It produces a risk score, a risk tier, and a documented assessment record that serves as an audit trail for regulatory examination.

The assessment is distinct from general due diligence in that it is scored, tiered, and repeatable. The same criteria apply to every vendor at the same tier, which means the output is comparable across your supplier base and defensible when a regulator asks why one vendor received enhanced monitoring and another did not.

A vendor risk assessment template standardises the criteria, the scoring methodology, and the documentation format across your team. Without a template, different assessors apply different standards to different vendors — which creates both compliance gaps and audit trail problems that regulators find during programme examination.

The Neotas vendor due diligence framework explains how the vendor risk assessment sits within the broader vendor relationship lifecycle from onboarding through to exit, and how assessment depth is calibrated by risk tier.

What a Vendor Risk Assessment Template Must Include

Blank templates from template websites give you a document structure with no scoring logic. That is not useful for a regulated organisation. A template that meets the documentation standard under DORA Article 28, OCC Bulletin 2013-29, and FCA PS7/23 requires six components.

Vendor identification and classification

Vendor legal name, registration number, jurisdiction of incorporation, primary contact, engagement type, and initial risk tier classification. Every subsequent reassessment must reference a consistent vendor identifier so the audit trail is traceable across the full relationship history.

Risk scoring criteria and category weighting

Each risk category carries a documented weight proportionate to your regulatory environment. A financial services firm subject to DORA weights cybersecurity and ICT concentration risk more heavily. A healthcare manufacturer subject to FDA QMSR weights quality and regulatory compliance more heavily. The weighting logic must be documented, not just the scores.

Assessment questionnaire by risk category

Minimum five risk categories, each with scored questions. Each question should return a score from 1 to 5 and reference the specific evidence required to validate the response. Self-reported answers without evidence validation are not sufficient for Critical and High tier vendors under any major regulatory framework.

Scoring methodology and risk tier output

The aggregate score maps to a risk tier: Critical, High, Medium, or Standard. The tier determines monitoring frequency, due diligence depth, and escalation path. The mapping must be documented so the tier assignment is reproducible and auditable, not a matter of individual assessor judgment on the day.

Evidence and documentation log

Every scored question must reference the supporting evidence: financial statements reviewed, certifications sighted, sanctions screening date and result, adverse media screening date and result, site visit report reference. Without an evidence log, the assessment is an opinion, not a documented finding that survives regulatory examination.

Review date and re-assessment triggers

The template must record the next scheduled assessment date and the conditions that trigger an unscheduled reassessment: sanctions designation, adverse media incident, financial distress signal, ownership change, data breach notification, or regulatory enforcement action against the vendor.

The Neotas enhanced due diligence checklist covers the specific evidence checks that go beyond self-reported questionnaire responses for Critical and High tier vendors, including adverse media in non-English languages and OSINT-based beneficial ownership investigation.

Vendor Risk Assessment Template: Scoring Framework

Use this framework as the foundation of your template. Adapt the category weights to your regulatory environment and risk appetite. The tier thresholds and weighting logic must be documented in your vendor risk assessment policy so scores are reproducible across assessors and over time.

75–100

Critical

Continuous monitoring, enhanced due diligence, board-level escalation, documented exit strategy required (DORA Art. 28(7))

50–74

High

Quarterly monitoring, enhanced due diligence, senior management review required

25–49

Medium

Bi-annual review, standard due diligence, questionnaire-based assessment acceptable

0–24

Standard

Annual review, questionnaire-based assessment, light-touch monitoring

Risk Category	Weight	What it covers	Regulatory relevance
Financial stability	20%	Credit rating, audited accounts, ownership changes, insolvency proceedings, financial restatements	OCC 2013-29 concentration risk; FCA PS7/23 financial viability
Cybersecurity and IT security	25%	ISO 27001, SOC 2, breach history, incident response, data storage locations, sub-processors, pen testing frequency	DORA Arts. 28-30 (ICT vendors); NIST SP 800-161 Rev. 1
Regulatory and compliance standing	25%	Sanctions screening (OFAC, HMT, EU), adverse media, PEP status, licence standing, UFLPA Entity List, active investigations	UFLPA; UK Modern Slavery Act; DORA; ECCTA 2023
Operational and quality resilience	15%	BCP tested, key person dependencies, sub-contractor mapping, service disruption history, geographic concentration	FDA QMSR (healthcare); DORA Art. 26 scenario testing
ESG and reputational conduct	15%	Modern slavery statement, labour rights violations, environmental enforcement, director misconduct, supply chain transparency	CS3D; German LkSG; UK Modern Slavery Act s.54

Scoring rule for Critical and High tier vendors: Self-reported answers without independently reviewed evidence cap at a score of 3 out of 5. Only independently verified answers score 5. This rule must be stated in the policy and enforced in the template, not left to assessor discretion.

Vendor Risk Assessment Questionnaire: 50 Questions by Category

This is a complete vendor risk assessment questionnaire template you can use directly. Each section maps to the scoring categories above. For Critical and High-risk vendors, each answer requires documented evidence. For Standard-tier vendors, self-reported responses are acceptable for initial screening only.

Section A: Financial Stability (10 questions — weight 20%)

Has the vendor provided audited financial statements for the last two financial years? (Evidence required: accounts reviewed, date sighted)
Does the vendor hold an active credit rating from a recognised agency? If yes, what is the current rating and agency?
Have there been any changes in beneficial ownership in the last 24 months? If yes, provide full details of the new ownership structure.
Is the vendor subject to any active insolvency, administration, or restructuring proceedings?
Has the vendor experienced any material financial restatements or audit qualifications in the last three years?
What is the vendor’s primary revenue source, and does it represent excessive revenue concentration risk for their business?
Has the vendor raised debt financing exceeding 50% of annual revenue in the last 12 months?
Are there any outstanding financial penalties, regulatory fines, or settlements? (Evidence required: disclosure statement)
Does the vendor maintain adequate professional indemnity and public liability insurance? (Evidence required: current certificate)
Has the vendor completed any mergers, acquisitions, or divestments in the last 24 months? If yes, provide details and impact on service continuity.

Section B: Cybersecurity and Information Security (12 questions — weight 25%)

Does the vendor hold a current ISO 27001 certification or equivalent? (Evidence required: certificate with expiry date)
Has the vendor completed a SOC 2 Type II audit in the last 12 months? (Evidence required: audit report summary)
Has the vendor experienced a data breach or security incident in the last 36 months? If yes, provide full details and remediation actions taken.
Does the vendor maintain a documented and tested incident response plan?
Where is all data processed and stored? Are all storage locations compliant with applicable data protection laws including GDPR?
Does the vendor maintain a current list of all sub-processors who may have access to your data?
What is the vendor’s penetration testing frequency, and when was the last test completed?
Does the vendor enforce multi-factor authentication for all staff with access to client systems?
Does the vendor operate a documented vulnerability management and patching programme?
For DORA-regulated ICT vendors: is there a documented business continuity plan with tested recovery time and recovery point objectives?
For DORA-regulated ICT vendors: does the vendor contractually agree to audit rights? (DORA Art. 30 requirement)
For DORA-regulated ICT vendors: are all sub-contracting arrangements disclosed and subject to notification requirements?

Section C: Regulatory and Compliance Standing (13 questions — weight 25%)

Has the vendor been screened against OFAC SDN, UK HMT Consolidated List, and EU Consolidated List? (Evidence required: screening result, date, tool used)
Have all beneficial owners been identified and screened for PEP status and sanctions exposure? (Evidence required: screening result and date)
Has adverse media screening been conducted across English and relevant non-English language sources? (Evidence required: result, date, languages covered)
Is the vendor subject to any active regulatory investigation, enforcement action, or licence suspension?
Does the vendor appear on the UFLPA Entity List? (Applicable for goods-supplying vendors with potential Xinjiang inputs)
For EU financial entities: has the vendor been designated as a critical ICT third-party provider under DORA?
Are all professional licences and regulatory registrations current and in good standing? (Evidence required: licence numbers and expiry dates)
Has the vendor had any licences revoked, suspended, or restricted in the last five years?
Does the vendor maintain a documented anti-bribery and corruption policy? (Evidence required: policy in place, date last reviewed)
Has the vendor been party to any bribery, corruption, or fraud investigations in the last five years?
Does the vendor comply with applicable data protection laws including GDPR for all EU data subjects?
Is the vendor’s beneficial ownership structure fully transparent and documented to ultimate beneficial owner level?
Has the vendor been subject to any asset freezing orders or court-ordered restraints in the last five years?

Section D: Operational and Quality Resilience (8 questions — weight 15%)

Does the vendor have a documented and tested business continuity plan? (Evidence required: plan in place, last test date)
Are there single-point-of-failure dependencies on key individuals? If yes, what mitigation is in place?
Has the vendor experienced material service disruptions, delivery failures, or quality incidents in the last 24 months?
Are all sub-contractors and critical upstream dependencies documented and disclosed?
For healthcare vendors: does the vendor operate under ISO 13485 or an equivalent quality management system?
For healthcare vendors: is there a documented supplier qualification programme for the vendor’s own supply chain?
What is the vendor’s geographic concentration risk? Are critical operations located in high-risk jurisdictions?
Does the vendor carry appropriate business interruption insurance? (Evidence required: current certificate)

Section E: ESG and Reputational Conduct (7 questions — weight 15%)

Does the vendor publish a modern slavery statement? (Required under UK Modern Slavery Act s.54 for organisations with £36M+ annual turnover)
Have there been any labour rights violations, forced labour allegations, or supply chain human rights concerns raised against the vendor in the last five years?
Is the vendor subject to any active environmental enforcement actions or material environmental liability?
Does the vendor have a published and independently verified environmental policy?
For EU vendors: is the vendor subject to CS3D or LkSG obligations? If yes, is their due diligence programme documented and up to date?
Has any director, officer, or beneficial owner been subject to disqualification, misconduct findings, or criminal proceedings in the last seven years?
Has the vendor been the subject of adverse media coverage in any language that has not been disclosed in this assessment? (This question must be validated by independent OSINT screening, not by the vendor’s self-reported answer)

Question 50 exposes the core gap in questionnaire-only programmes: A vendor with adverse media coverage in local-language press will answer “no” and the questionnaire will score it clean. Independent OSINT screening across 200+ languages is what surfaces what the vendor chooses not to disclose. The Neotas enhanced due diligence platform runs this as part of the standard vendor assessment workflow.

Neotas — Rated Chartis FCC50

Your vendor risk assessment questionnaire captures disclosure. OSINT captures reality.

Neotas combines the 50-question template above with OSINT-enhanced due diligence across 200+ languages, continuous monitoring, and a full regulatory audit trail. A FTSE 250 client using this approach found 27 material risk indicators where their questionnaire-only programme had flagged 3.

See how it works

Vendor Risk Assessment Template: Excel and XLS Format

The template above is designed for export to Excel (.xlsx), Google Sheets, or XLS format. When building your working file, structure the spreadsheet across five tabs. Each tab serves a distinct function in the audit trail.

Tab 1: Vendor Register

One row per vendor. Columns: vendor ID, legal name, tier classification, last assessment date, next assessment date, assigned assessor, overall risk score, risk tier, and open remediation actions. This is the programme-level view regulators request first.

Tab 2: Assessment Form

The 50-question questionnaire with dropdown scoring (1, 3, 5), evidence reference fields, and auto-calculated category and overall scores. Lock the scoring logic and category weights on a protected sheet so assessors cannot modify the methodology mid-assessment.

Tab 3: Scoring Methodology

The weighting table, tier thresholds, and methodology rationale. This tab is your audit trail for the scoring design itself. Regulators under DORA and OCC Bulletin 2013-29 expect evidence that the scoring methodology was designed deliberately, not arrived at ad hoc.

Tab 4: Evidence Log

Linked to Tab 2. One row per piece of evidence per vendor: document type, date reviewed, reviewed by, storage location, and expiry or re-review date. This is the specific tab regulators examine when verifying that assessment scores are backed by reviewed evidence, not self-reported claims.

Tab 5: Monitoring Dashboard

Auto-populated from Tab 1. Shows vendors overdue for reassessment, open alerts, and tier distribution across the portfolio. For teams managing more than 50 vendors, this tab is where manual spreadsheet programmes begin to break down — version control, methodology drift, and audit trail gaps accumulate faster than most teams track.

Scaling consideration: The Neotas platform replaces the manual spreadsheet tabs above with a workflow that enforces the methodology, generates the audit trail automatically, and triggers real-time monitoring alerts. For teams managing more than 50 critical or high-risk vendors, a spreadsheet template creates version control, methodology drift, and audit trail gaps that a purpose-built platform resolves. The Neotas TPRM guide explains how the platform works.

Vendor Risk Assessment Policy: What It Must Cover

A vendor risk assessment policy is the governance document that mandates the template, scoring methodology, and programme design across the organisation. Without it, the template is optional. With it, deviating from the template requires a documented exception with rationale and approval.

A policy aligned to DORA Article 28, FCA PS7/23, and OCC Bulletin 2013-29 must cover the following elements. Missing any one of them creates a documented gap that regulators identify during programme examination.

Policy element	What it must cover	Regulatory mandate
Scope definition	Which vendors are in scope, defined by engagement type, data access, revenue dependency, and regulatory classification. Specific enough that any relationship is unambiguously in-scope or out-of-scope.	DORA Art. 28 (ICT providers); OCC 2013-29 (all third parties)
Risk tiering methodology	Criteria for classifying vendors as Critical, High, Medium, or Standard. Must be documented at policy level, not left to assessor discretion. Tier classification determines assessment depth and monitoring cadence.	FCA PS7/23; OCC 2013-29; DORA Art. 28
Due diligence standards by tier	What specific checks are required at each tier. Critical and High vendors require independent screening, not just questionnaire responses. Standard vendors may use questionnaire alone for initial screening with periodic independent validation.	DORA Art. 28 (enhanced for critical); FCA PS7/23
Monitoring cadence	Continuous for Critical (DORA requirement for designated ICT providers), quarterly for High, bi-annual for Medium, annual for Standard. Event-triggered reassessment conditions explicitly listed.	DORA Art. 28 (continuous for critical ICT); FCA PS7/23
Escalation paths	What score or finding triggers senior management review, what triggers board notification, what triggers vendor exit recommendation. These thresholds must be documented before an incident forces the process.	FCA PS7/23; PRA SS2/21; DORA Art. 28
Exit strategy requirements	For Critical vendors, a documented exit plan is required. The policy must mandate that no vendor is classified Critical without an exit plan in place. A contractual termination clause is not an exit plan.	DORA Art. 28(7); OCC 2013-29; FCA PS7/23
Review cycle	Annual policy review at minimum, with immediate update required following any regulatory change affecting scope or standards. Policy version number and board approval date must be documented.	ISO 31000:2018; DORA Art. 28; all major frameworks

See how to build a TPRM policy that meets DORA, FCA, and OCC requirements — the same governance document that mandates your vendor risk assessment template across the organisation.

Vendor Risk Assessment Process: From Initiation to Ongoing Monitoring

Most vendor risk assessment templates cover the point-in-time assessment only. The process surrounding the template is what determines whether it produces managed risk or documented risk. These are the six stages of a complete vendor risk assessment process.

Initiation and pre-screening

Before the full template is completed, run a rapid pre-screen: sanctions list check, adverse media check, PEP check on beneficial owners, and a basic financial health signal. This filters out vendors that should never reach the full assessment stage, preventing teams from investing full assessment time on relationships that would be immediately disqualified.

Template completion and evidence collection

The 50-question template completed by the vendor and validated by an independent assessor. For Critical and High tier vendors, each answer must be backed by reviewed evidence logged in the evidence tab. Self-reported answers without evidence validation cap at a score of 3 regardless of what the vendor claims.

Independent intelligence validation

Adverse media screening across non-English sources, OSINT investigation of beneficial ownership structures, cross-referencing with regulatory enforcement databases, and financial health monitoring. This is the stage where the gap between questionnaire score and actual risk emerges. A FTSE 250 manufacturer found 27 vendors with material risk indicators where their questionnaire-only process had flagged three.

Scoring, tiering, and risk register update

Apply the scoring methodology, calculate category scores and overall score, assign the risk tier, and update the vendor register. Document the tier rationale, not just the score. The rationale is what survives regulatory examination when a regulator asks why a vendor received a particular tier classification.

Ongoing monitoring by tier

For Critical vendors: continuous real-time monitoring for sanctions designations, adverse media, financial distress signals, and ESG incidents. For High: quarterly re-screening. For Medium: bi-annual. For Standard: annual. A UK-regulated financial institution using Neotas continuous monitoring across 180 critical third parties generated 14 material alerts in the first 90 days — three required immediate board escalation and none had appeared in the prior annual review cycle.

Event-triggered reassessment

Certain events require immediate reassessment regardless of the scheduled cadence: ownership change, sanctions designation of the vendor or a beneficial owner, material adverse media incident, regulatory enforcement action, financial distress signal, or notification of a data breach or security incident affecting your data or service continuity.

The TPRM lifecycle guide covers how the vendor risk assessment process sits within the full vendor relationship from onboarding through to exit, including contract provisions and exit strategy requirements.

NIST Vendor Risk Assessment Questionnaire Alignment

For organisations subject to NIST SP 800-161 Rev. 1 — mandatory for US federal contractors and widely adopted across critical infrastructure sectors including financial services, energy, healthcare, and defence — the vendor risk assessment questionnaire must align to the C-SCRM practice areas.

NIST C-SCRM Practice	What it requires	Template coverage above
C-SCRM-1: Establish a programme	Board-approved policy, defined roles, documented risk appetite, review cycle	VRA Policy section above
C-SCRM-2: Identify and assess supply chain risks	Supplier categorisation, risk identification across categories, scored assessment	Scoring Framework + Sections A through E
C-SCRM-3: Establish controls	Control selection matched to risk tier, documented rationale, evidence of implementation	Scoring methodology + tier thresholds + evidence log (Tab 4)
C-SCRM-6: Manage supply chain risks	Ongoing monitoring, event-triggered reassessment, escalation to appropriate level	Process Stage 5 (monitoring) and Stage 6 (event-triggered reassessment)

For federal contractors, the evidence log (Tab 4 of the Excel template) is the primary document during an assessment review. It must show that independent validation was conducted for each scored answer, not just that the vendor submitted documentation.

Cyber Vendor Risk Assessment: Additional Questions for ICT and Technology Vendors

For technology vendors, software providers, cloud services, and ICT third parties subject to DORA designation, extend the standard 50-question template with these additional cyber-specific questions. Each one maps to a specific DORA or NIST SP 800-161 requirement.

Section F: Extended Cyber and ICT Questions (for technology vendors and DORA-designated providers)

Does the vendor operate a vulnerability disclosure programme? Have any critical vulnerabilities been disclosed in the last 12 months? (NIST SP 800-161 Rev. 1 alignment)
Does the vendor maintain an accurate software bill of materials (SBOM) for all software components supplied to your organisation?
Has the vendor implemented a secure development lifecycle (SDLC)? Is this independently certified or audited?
Does the vendor’s BCP include specific recovery time objectives (RTOs) and recovery point objectives (RPOs) for services provided to your organisation? (DORA Art. 28 requirement)
Does the vendor notify you within 24 hours of any security incident that could affect your data or service continuity? (DORA Art. 28 contractual requirement for critical ICT providers)
Does the vendor maintain cyber insurance? What is the coverage limit and does it cover third-party liability?
What is the vendor’s policy on use of open-source components? Is there a documented process for monitoring and patching open-source vulnerabilities?
Has the vendor conducted a supply chain attack simulation or red team exercise targeting their software development pipeline in the last 24 months?

See how the Neotas TPRM guide covers the full programme — risk tiering, governance, and regulatory alignment across DORA Arts. 28-30, FCA PS7/23, and OCC Bulletin 2013-29 — that the vendor risk assessment template sits within.

5 Vendor Risk Assessment Template Mistakes That Fail Regulatory Examination

These are the specific gaps regulators find during examination of vendor risk assessment programmes. They appear in post-examination feedback from FCA, OCC, and DORA competent authority reviews.

Mistake 1: No evidence log behind the scores

A vendor risk assessment template that produces a score without an evidence log is an opinion document. Regulators ask: “What evidence did you review to assign this score?” If the answer is “the vendor completed the questionnaire,” that is not satisfactory for a Critical or High tier vendor. The evidence log is what converts a score into a documented, auditable finding.

Mistake 2: Screening conducted at onboarding only

A vendor that cleared sanctions screening in January can be designated on the OFAC SDN list in September. An annual assessment does not catch this. For Critical vendors, real-time or near-real-time sanctions monitoring is the current regulatory expectation under DORA Article 28 and FCA PS7/23. The template must specify the monitoring cadence and the tooling that enforces it between full assessments.

Mistake 3: Category weights not documented

If the template produces a composite score but the category weights are not recorded, the score is not reproducible. A different assessor applying different implicit weights produces a different score for the same vendor. Regulators test for methodological consistency across assessors and over time. The weight table must be in the policy or on a protected tab of the Excel template.

Mistake 4: No escalation threshold defined in the policy

A template that produces a High risk score with no documented process for what happens next is a documentation exercise. At what score does the result escalate to senior management? At what score does it go to the board? At what score does it trigger a vendor exit recommendation? These thresholds must be in the policy and must have been tested before an incident forces them into use.

Mistake 5: Template covers only the vendor’s self-reported view

Every question in a questionnaire-only template is answered by the team with the most incentive to present the vendor favourably. Independent screening of sanctions, adverse media, financial health, and PEP status is not a supplement to the template for Critical and High vendors. It is a required component of the template. Without it, the assessment scores a vendor’s willingness to disclose, not its actual risk profile.

The Neotas enhanced due diligence checklist covers the specific independent checks — beyond questionnaires — that surface the risks structured databases and self-assessments consistently miss, including OSINT across 200+ languages.

Free programme review

Is your vendor risk assessment programme audit-ready?

DORA Article 28, FCA PS7/23, and OCC 2013-29 have raised the documentation standard significantly since 2023. A 30-minute call with a Neotas specialist will identify the specific gaps in your current template and programme design before a regulator does.

Request the review

What a Vendor Risk Assessment Means for Your Role

Different stakeholders in a vendor risk assessment programme face different primary exposures. This section addresses each directly.

Compliance Director / Head of Compliance

Your exposure is a regulatory examination that finds programme gaps: missing evidence logs, undocumented scoring methodology, absent exit strategies, or annual reviews replacing continuous monitoring for Critical vendors. The specific artefacts regulators request are the evidence log, the policy version with approval date, and the methodology rationale. Most programmes cannot produce all three on demand.

General Counsel / Legal

Your exposure sits in three places: UFLPA rebuttable presumption if you import goods with potential Xinjiang supply chain inputs; CS3D and LkSG ESG obligations if you are a large EU company; and DORA ICT supplier obligations if you are an in-scope financial entity. The due diligence standard these regulations require is not satisfied by questionnaires. Independent verification, documentary traceability, and a maintained risk register are each required.

Procurement Director / Head of Vendor Management

Your operational exposure is a critical vendor failure with no fallback and no documented exit plan. Your strategic exposure is an ESG or sanctions controversy that forces a rapid vendor exit your contracts and operations are unprepared to execute. Continuous monitoring for Critical vendors and documented exit strategies for sole-source relationships are the two capabilities that most directly reduce your exposure.

Chief Risk Officer / Head of Operational Risk

The investment case for a mature vendor risk assessment programme is not difficult to make: companies without one experience 3.7 times higher revenue impact from third-party disruptions than companies with one (Deloitte, 2024). The cost of building a programme that passes examination is consistently lower than the cost of one significant incident or one regulatory enforcement action it prevents.

Ready to build a vendor risk assessment programme that holds up under examination?

Talk to a Neotas specialist about your vendor assessment programme

Whether you need the template adapted to your regulatory environment, your scoring methodology reviewed against DORA and OCC standards, or your programme upgraded from questionnaire-only to OSINT-enhanced, a 30-minute conversation will tell you exactly where to start.

Schedule a meeting
Read the TPRM guide

Rated Chartis FCC50 · US, UK and EU enterprise clients · 200+ languages, 190+ jurisdictions

Vendor Risk Assessment Template

Download the Vendor Risk Assessment Template and turn vendor risk into a controlled, repeatable process today.

Frequently Asked Questions: Vendor Risk Assessment Template

Answers drawn from confirmed People Also Ask and search intent data for vendor risk assessment queries across US and UK search results.

What is a vendor risk assessment template?▾

A vendor risk assessment template is a standardised framework that applies consistent risk criteria, scoring methodology, and documentation requirements to the evaluation of every vendor or third-party supplier. It covers financial stability, cybersecurity posture, regulatory compliance, operational resilience, and ESG conduct in one scored document. The output is a risk score, a risk tier (Critical, High, Medium, or Standard), and an evidence log that serves as an audit trail under DORA Article 28, FCA PS7/23, and OCC Bulletin 2013-29. Without all three outputs, the template does not meet the documentation standard required for regulatory examination.

What should a vendor risk assessment questionnaire include?▾

A complete vendor risk assessment questionnaire should cover five risk categories: financial stability (ownership, financial health, insurance), cybersecurity and information security (certifications, breach history, incident response), regulatory and compliance standing (sanctions screening, adverse media, PEP checks, licence status), operational and quality resilience (business continuity, sub-contractor dependencies, quality certifications), and ESG conduct (modern slavery, environmental policy, governance failures). For Critical and High-risk vendors, each answer must be backed by independently reviewed evidence, not just vendor-supplied self-reporting. The full 50-question template in this guide covers all five categories.

How do you score a vendor risk assessment?▾

Score each question on a 1 to 5 scale: 1 (significant concern evidenced), 3 (some concern, manageable, or self-reported answer without independent verification), 5 (no concern, evidence independently reviewed). Apply the category weight to each category’s average score. Sum the weighted category scores to produce an overall score from 0 to 100. Map the overall score to a risk tier: Critical (75-100), High (50-74), Medium (25-49), Standard (0-24). Document the weighting logic and tier thresholds in a policy or locked template tab so the methodology is reproducible across assessors and over time. Undocumented scoring logic does not survive regulatory examination.

What is the difference between a vendor risk assessment and vendor due diligence?▾

A vendor risk assessment evaluates a specific vendor against standardised criteria and produces a scored, tiered output. It is the mechanism. Vendor due diligence is the investigative activity that provides the evidence for the assessment — financial statement review, sanctions screening, adverse media investigation, OSINT research, site visits. The two are complementary: the template defines what to assess, and due diligence provides the evidence behind each finding. For Critical vendors, due diligence must include independent intelligence sources beyond questionnaire responses.

Does a vendor risk assessment template satisfy DORA Article 28 requirements?▾

A template alone does not satisfy DORA Article 28. DORA requires: a documented ICT third-party risk policy, pre-engagement due diligence with independently verified evidence, ongoing monitoring for critical ICT providers (continuous, not annual), concentration risk assessment and reporting to the competent authority, contractual protections including audit rights, and documented exit strategies for critical providers under Article 28(7). A template is the assessment component of this programme. It must be supported by a policy, a continuous monitoring mechanism, and contractual provisions to constitute a DORA-compliant TPRM programme.

What is a vendor risk assessment policy?▾

A vendor risk assessment policy is the governance document that mandates the template, scoring methodology, tiering criteria, due diligence standards by tier, monitoring cadence, escalation paths, and exit strategy requirements across the organisation. Without a policy, the template is optional and inconsistently applied. With a policy, deviation requires a documented exception. The policy is the document regulators under DORA, FCA, and OCC request first when examining a TPRM programme. It must record the board approval date, version number, and annual review date.

How often should vendor risk assessments be conducted?▾

Assessment cadence depends on the vendor’s risk tier. Critical vendors require continuous monitoring between annual full assessments. DORA Article 28 mandates ongoing monitoring for designated critical ICT providers — not annual point-in-time reviews. High-risk vendors should be reassessed quarterly at minimum. Medium-risk vendors bi-annually. Standard vendors annually. All vendors require event-triggered reassessment following a sanctions designation, material adverse media incident, ownership change, data breach, or regulatory enforcement action regardless of the scheduled cadence.

What is a NIST vendor risk assessment questionnaire?▾

A NIST vendor risk assessment questionnaire aligns to NIST SP 800-161 Rev. 1, the US government’s framework for cybersecurity supply chain risk management published in May 2022. It is mandatory for US federal contractors and widely adopted by critical infrastructure sectors including financial services, energy, healthcare, and defence. The questionnaire covers ICT supplier identification and categorisation, risk assessment methodology, control selection, and supply chain risk monitoring. The 50-question template in this guide covers the core NIST C-SCRM practice areas. Federal contractors should supplement it with agency-specific requirements from their contracting documents.

Can I use a free vendor risk assessment template?▾

A free vendor risk assessment template from a template website provides a document structure without scoring logic. It does not include a scoring methodology that reflects your regulatory obligations, category weights calibrated to your risk appetite, evidence validation standards that satisfy DORA or OCC examination requirements, or a policy framework that makes the template mandatory across your organisation. The 50-question template in this guide is free. The gap between a blank document and a compliant programme is the scoring methodology, the evidence standards, the policy, and the monitoring cadence that surrounds it.

What is the vendor risk assessment process?▾

The vendor risk assessment process has six stages: (1) initiation and pre-screening — rapid sanctions, adverse media, and PEP check before committing full assessment resource; (2) template completion and evidence collection — the scored questionnaire backed by reviewed evidence; (3) independent intelligence validation — OSINT and commercial screening beyond self-reported answers; (4) scoring, tiering, and risk register update — documented rationale, not just a score; (5) ongoing monitoring by tier — continuous for Critical, quarterly for High, bi-annual for Medium, annual for Standard; (6) event-triggered reassessment — immediate reassessment following any material risk event regardless of schedule.

What vendor risk assessment criteria should I use?▾

The five standard vendor risk assessment criteria categories are: financial stability (20% weighting), cybersecurity and information security (25%), regulatory and compliance standing (25%), operational and quality resilience (15%), and ESG and reputational conduct (15%). The specific weighting should be adjusted to your regulatory environment: financial services firms subject to DORA weight cybersecurity and ICT concentration risk more heavily; healthcare manufacturers subject to FDA QMSR weight quality and regulatory compliance more heavily. The weighting rationale must be documented at policy level.

What is a third-party vendor risk assessment?▾

A third-party vendor risk assessment evaluates the risks that a vendor, supplier, or external service provider introduces to your organisation. The terms “third-party risk assessment” and “vendor risk assessment” are used interchangeably in most regulatory frameworks. DORA uses the TPRM framing (third-party risk management) covering all ICT providers. UFLPA uses the supply chain framing covering goods suppliers. OCC Bulletin 2013-29 covers all third-party relationships. The same template and scoring methodology applies to both, with category weighting adjusted to the vendor type — technology provider weighting favours cybersecurity and ICT concentration risk; goods supplier weighting favours operational resilience and ESG conduct.

What is a vendor cyber risk assessment?▾

A vendor cyber risk assessment evaluates the cybersecurity and ICT risk a technology vendor or software provider introduces to your organisation. It covers certifications (ISO 27001, SOC 2), breach history, incident response, data storage locations, sub-processor list, penetration testing frequency, vulnerability management, and for DORA-regulated ICT providers: business continuity with tested recovery objectives, contractually agreed audit rights, and sub-contracting disclosure. The standard 50-question template in this guide includes the full Section B (cybersecurity, 12 questions) and a Section F extension (8 additional questions) for ICT and technology vendors.

What vendor risk assessment tools are available?▾

Vendor risk assessment tools fall into four categories: TPRM platforms (lifecycle management, questionnaires, risk scoring, continuous monitoring, audit trail); commercial data and screening tools (sanctions lists, adverse media, financial health databases updated in real or near-real time); OSINT and open-source investigation tools (non-English news, court records, corporate registries, analyst-led investigation); and GRC platforms (governance, risk, and compliance workflow management). Most mature vendor risk assessment programmes combine tools from multiple categories. The right configuration depends on vendor volume, geographic footprint, and the specific regulatory obligations — DORA, UFLPA, CS3D, or FDA QMSR — that apply to your organisation.

What is a vendor management risk assessment template?▾

A vendor management risk assessment template is a vendor risk assessment template used within a formal vendor management programme. The distinction is scope: vendor management covers the entire vendor relationship lifecycle — onboarding, performance, risk, contract management, and exit. The risk assessment template is the risk management component of that programme. In regulated organisations, the two are closely integrated: the risk tier assigned by the assessment determines the contract provisions, monitoring cadence, and exit planning obligations applied throughout the vendor management lifecycle.

Last Updated on August 3, 2026

financial crime compliance
financial crimes compliance
what is financial crime compliance
financial crime and compliance
financial crime and compliance management
financial crime compliance jobs
financial crime compliance solutions
financial crimes compliance jobs
compliance and financial crime
cost of financial crime compliance
enterprise financial crimes compliance
fcc financial crime compliance
anti financial crime compliance
conduct financial crime and compliance

financial crime compliance analyst
financial crime compliance analyst salary
financial crime compliance certification
financial crime compliance course
financial crime compliance definition
financial crime compliance framework
financial crime compliance in banking
financial crime compliance meaning
financial crime compliance risk management
global financial crimes compliance
true cost of financial crime compliance global report
what is financial crimes compliance

Neotas Enhanced Due Diligence

Neotas Enhanced Due Diligence covers 600Bn+ Archived web pages, 1.8Bn+ court records, 198M+ Corporate records, Global Social Media platforms, and more than 40,000 Media sources from over 100 countries to help you screen & manage risks.

Vendor Risk Assessment Template

Download the Neotas Vendor Risk Assessment Template and turn vendor risk into a controlled, repeatable process today.

Unmatched Risk Intelligence Across All Industries

An advanced Due Diligence Platform that leverages AI to join the dots between Social Media, Corporate Records, Adverse Media and Open Source Intelligence (OSINT).

Real-Time, Actionable Intelligence

Our platform offers the most advanced insights, so you can respond to risks immediately.

Comprehensive Global Coverage

With insights spanning global jurisdictions, your business is never in the dark.

Scalable Solutions

Whether you manage a small portfolio or a global enterprise, our platform adapts to your needs

Schedule a Call

Ready to Transform Your Third-Party Risk Approach?

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.

Necessary

Always Enabled

Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.

Cookie	Duration	Description
AWSALBTG	7 days	AWS Application Load Balancer Cookie. Load Balancing Cookie: Used to encode information about the selected target group.
AWSALBTGCORS	7 days	AWS Classic Load Balancer Cookie: Used to map the session to the instance. This cookie is identical to the original ELB cookie except for the attribute &SameSite=None;
cookielawinfo-checkbox-advertisement	1 year	Set by the GDPR Cookie Consent plugin, this cookie is used to record the user consent for the cookies in the "Advertisement" category .
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
CookieLawInfoConsent	1 year	Records the default button state of the corresponding category & the status of CCPA. It works only in coordination with the primary cookie.
debug	never	Cookie used to debug code and website issues
shown	session	Session cookie to control number of times a pop up is shown.
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

Functional

Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.

Cookie	Duration	Description
__cf_bm	30 minutes	This cookie, set by Cloudflare, is used to support Cloudflare Bot Management.
AnalyticsSyncHistory	1 month	Used to store information about the time a sync took place with the lms_analytics cookie
bcookie	2 years	LinkedIn sets this cookie from LinkedIn share buttons and ad tags to recognize browser ID.
bscookie	2 years	LinkedIn sets this cookie to store performed actions on the website.
lang	session	LinkedIn sets this cookie to remember a user's language setting.
lidc	1 day	LinkedIn sets the lidc cookie to facilitate data center selection.
UserMatchHistory	1 month	LinkedIn sets this cookie for LinkedIn Ads ID syncing.

Performance

Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.

Cookie	Duration	Description
li_gc	2 years	Used to store consent of guests regarding the use of cookies for non-essential purposes
rl_anonymous_id	1 year	Generates an unique anonymous Id to identify a user and attach to a subsequent event.
rl_user_id	1 year	to store a unique user ID for the purpose of Marketing/Tracking

Analytics

Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.

Cookie	Duration	Description
_ga	2 years	The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors.
_gat_gtag_UA_107495977_1	1 minute	Set by Google to distinguish users.
_gat_UA-107495977-1	1 minute	A variation of the _gat cookie set by Google Analytics and Google Tag Manager to allow website owners to track visitor behaviour and measure site performance. The pattern element in the name contains the unique identity number of the account or website it relates to.
_gcl_au	3 months	Provided by Google Tag Manager to experiment advertisement efficiency of websites using their services.
_gid	1 day	Installed by Google Analytics, _gid cookie stores information on how visitors use a website, while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source, and the pages they visit anonymously.
attribution_user_id	1 year	This cookie is set by Typeform for usage statistics and is used in context with the website's pop-up questionnaires and messengering.
CONSENT	2 years	YouTube sets this cookie via embedded youtube-videos and registers anonymous statistical data.

Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.

Cookie	Duration	Description
_fbp	3 months	This cookie is set by Facebook to display advertisements when either on Facebook or on a digital platform powered by Facebook advertising, after visiting the website.
fr	3 months	Facebook sets this cookie to show relevant advertisements to users by tracking user behaviour across the web, on sites that have Facebook pixel or Facebook social plugin.
IDE	1 year 24 days	Google DoubleClick IDE cookies are used to store information about how the user uses the website to present them with relevant ads and according to the user profile.
test_cookie	15 minutes	The test_cookie is set by doubleclick.net and is used to determine if the user's browser supports cookies.
VISITOR_INFO1_LIVE	5 months 27 days	A cookie set by YouTube to measure bandwidth that determines whether the user gets the new or old player interface.
YSC	session	YSC cookie is set by Youtube and is used to track the views of embedded videos on Youtube pages.
yt-remote-connected-devices	never	YouTube sets this cookie to store the video preferences of the user using embedded YouTube video.
yt-remote-device-id	never	YouTube sets this cookie to store the video preferences of the user using embedded YouTube video.
yt.innertube::nextId	never	This cookie, set by YouTube, registers a unique ID to store data on what videos from YouTube the user has seen.
yt.innertube::requests	never	This cookie, set by YouTube, registers a unique ID to store data on what videos from YouTube the user has seen.

Others

Vendor Risk Assessment Template

What Is a Vendor Risk Assessment?

What a Vendor Risk Assessment Template Must Include

Vendor Risk Assessment Template: Scoring Framework

Vendor Risk Assessment Questionnaire: 50 Questions by Category

Your vendor risk assessment questionnaire captures disclosure. OSINT captures reality.

Vendor Risk Assessment Template: Excel and XLS Format

Vendor Risk Assessment Policy: What It Must Cover

Vendor Risk Assessment Process: From Initiation to Ongoing Monitoring

NIST Vendor Risk Assessment Questionnaire Alignment

Cyber Vendor Risk Assessment: Additional Questions for ICT and Technology Vendors

5 Vendor Risk Assessment Template Mistakes That Fail Regulatory Examination

Is your vendor risk assessment programme audit-ready?

What a Vendor Risk Assessment Means for Your Role

Talk to a Neotas specialist about your vendor assessment programme

Vendor Risk Assessment Template

Related reading

Don’t let vendor risk sit in a binder. Turn this template into action.

Ready to see how this works in your organisation?

Frequently Asked Questions: Vendor Risk Assessment Template

Share:

Neotas Enhanced Due Diligence

Vendor Risk Assessment Template

Related Blog Posts

Unmatched Risk Intelligence Across All Industries

Real-Time, Actionable Intelligence

Comprehensive Global Coverage

Scalable Solutions

Schedule a Call

One platform. Every third-party risk, screened, monitored, and audit-ready.