A third-party risk assessment is a structured process for identifying, scoring, and documenting the risks that vendors, suppliers, and service providers introduce to your organisation. It examines financial stability, cybersecurity controls, regulatory compliance, operational resilience, and reputational exposure, then assigns a risk tier that determines how the third party needs to be managed and monitored.
This guide covers what a third-party risk assessment involves, how to run one step by step, what each risk category requires, and how purpose-built platforms give compliance teams the speed and defensibility that regulators now expect.
Run structured, regulator-ready third-party risk assessments across cybersecurity, financial, ESG, and reputational risk.
A third-party risk assessment is a formal evaluation of the risks that a vendor, supplier, partner, or service provider introduces to your organisation. It covers financial stability, cybersecurity controls, regulatory compliance, operational resilience, and reputational exposure, then assigns a risk tier that determines how closely the relationship needs to be managed.
The assessment sits within a broader third-party risk management (TPRM) programme. TPRM covers the full vendor lifecycle. The assessment is the intelligence-gathering stage: the point at which your team decides whether a relationship poses acceptable risk and at what monitoring level.
The two terms are used interchangeably in practice, but there is a distinction worth noting. Vendor risk assessment typically focuses on commercial suppliers and their operational and cybersecurity posture. Third-party risk assessment is broader: it covers vendors, but also contractors, consultants, joint venture partners, and any external entity with access to your systems, data, or operations. This page covers both.
Regulators in the US have become explicit about what “adequate” looks like. OCC Bulletin 2023-17 requires banks to conduct risk assessments on third parties and demonstrate ongoing oversight, not just initial due diligence. NIST SP 800-161 sets out supply chain risk management practices for federal contractors. The FCA’s FG 18/5 specifically endorses open-source internet checks as best practice for assessing third-party exposure.
A questionnaire sent and filed is no longer sufficient. Regulators expect evidence that responses were verified against independent sources and that a documented risk decision followed.
A complete third-party risk assessment addresses six distinct risk types. Missing any one of them creates gaps that auditors and examiners will identify.
This is the most scrutinised category in current regulatory environments. It covers how the third party protects data, manages access controls, handles vulnerabilities, and responds to incidents.
Assessors look for: SOC 2 Type II certification, ISO 27001 accreditation, evidence of penetration testing, incident response plans, data processing agreements, and breach history. For vendors with access to sensitive systems, this category requires enhanced due diligence.
Can the vendor comply with the regulations that apply to your organisation? A financial institution using a vendor that processes customer data must ensure that vendor meets GDPR, CCPA, or applicable state-level requirements. A healthcare organisation must confirm HIPAA compliance.
This category also includes sanctions screening. Working with a vendor listed on OFAC, UN, or EU sanctions lists creates direct legal and reputational exposure.
A vendor that becomes insolvent mid-contract creates operational disruption and potential data risk. Financial assessments cover credit ratings, payment history, filed accounts, litigation history, and ownership structure.
Ownership structure matters more than most teams account for. A financially stable subsidiary of an at-risk parent company carries inherited risk. Understanding the full corporate structure, including ultimate beneficial ownership (UBO), is essential for regulated entities.
What happens to your operations if this vendor fails to deliver? This category covers concentration risk (over-reliance on a single provider), geographic risk (vendors in politically unstable regions), disaster recovery capability, and subcontractor dependencies.
Subcontractor dependencies are what the industry calls fourth-party risk. Your vendor may be low-risk in isolation, but if they rely on a high-risk subcontractor with access to your data, that risk flows through to you.
A vendor’s conduct, public record, and associations can damage your organisation’s reputation even where there is no direct financial or operational harm. This is the category where open-source intelligence (OSINT) becomes critical.
Standard database checks do not surface reputational risk reliably. Court filings in non-English jurisdictions, adverse media from archived regional sources, and social media records require broader search coverage. According to Neotas platform data, a significant portion of material reputational findings in enhanced due diligence cases come from sources outside standard database providers.
ESG risk assessment has shifted from a best practice to a regulatory requirement in multiple jurisdictions. The EU Corporate Sustainability Due Diligence Directive (CSDDD) and the UK Modern Slavery Act create obligations to assess vendors for labour practices, environmental conduct, and governance standards.
Failing to assess ESG risk is increasingly treated as a compliance failure, not a gap in ambition.
A structured third-party risk assessment follows a repeatable sequence. These steps apply equally to initial onboarding assessments and periodic reassessments.
Step 1: Classify the vendor by risk tier. Before the assessment begins, assign a risk tier based on: the sensitivity of data the vendor accesses, the criticality of services they provide, their regulatory environment, and the geographic regions they operate in. High-risk vendors require enhanced due diligence. Low-risk vendors with no system access may require only a simplified check. The tier determines the depth of every step that follows.
Step 2: Collect structured vendor information. Use a standardised questionnaire to collect information directly from the vendor. This covers: corporate structure and ownership (including UBO), cybersecurity controls and certifications, data handling and privacy practices, business continuity plans, and subcontractor dependencies. The Neotas TPRM Questionnaire (VDDQ) covers all six risk categories in a single structured document. It is available as a free download.
Step 3: Verify responses against independent sources. Questionnaire responses tell you what the vendor says about themselves. Independent verification tells you what is actually true. This step involves checking corporate registry filings, court records, sanctions and PEP databases, adverse media, and OSINT sources across multiple languages and jurisdictions. Do not rely on questionnaire responses alone.
Step 4: Score inherent risk. Before considering the vendor’s controls, score the raw risk they introduce based on data sensitivity, service criticality, and regulatory exposure. Inherent risk scoring creates a baseline that is independent of vendor claims.
Step 5: Assess controls and score residual risk. After reviewing and verifying the vendor’s controls, certifications, and track record, score residual risk: what remains after mitigation. A vendor with high inherent risk but robust, verified controls may have acceptable residual risk. A vendor with moderate inherent risk and no verifiable controls is a higher concern than their inherent score suggests.
Step 6: Document the risk decision. Based on residual risk, make one of three documented decisions: approve with standard monitoring, approve with enhanced monitoring and contractual conditions, or decline. The decision and the evidence base must be recorded in a format you can retrieve and present to a regulator or auditor immediately.
Step 7: Set the monitoring cadence. The assessment is not a one-time event. High-risk vendors require continuous monitoring or quarterly reviews. Standard-risk vendors warrant annual reassessment as a minimum. Configure real-time alerts for material changes: sanctions screening hits, adverse media, ownership changes, and financial distress signals.
Most organisations have some form of vendor assessment. Few have one that would satisfy an OCC examination or FCA review. The difference comes down to three things.
A questionnaire accepted at face value is a data collection exercise, not due diligence. Defensible due diligence requires that responses are tested against independent sources: corporate registries, court records, sanctions databases, adverse media, and OSINT.
According to Neotas platform data, analyst review combining questionnaire responses with OSINT investigation identified material discrepancies in ultimate beneficial ownership structures in a significant proportion of enhanced due diligence cases reviewed in 2024. These discrepancies did not appear in questionnaire responses.
Standard database providers index what is straightforward to index: major news outlets, English-language filings, structured data sources. Reputational risk and regulatory breaches often surface in regional media, archived sources, and non-English content. An assessment that misses that content is incomplete regardless of how many boxes it ticks.
Neotas searches 600Bn+ archived web pages, 1.8Bn+ court records, 198M+ corporate records, and 40,000+ active media sources across 100+ countries in 40+ native languages.
Every finding, every decision, and every piece of evidence must be recorded in a retrievable, time-stamped format. When a regulator asks why a particular vendor was approved at a specific risk tier, you need to produce the evidence immediately. Platforms that generate structured, defensible reports are what separate organisations that pass examinations from those that don’t.
Neotas is a risk intelligence and enhanced due diligence platform built for teams that need to run assessments at scale without compromising depth or defensibility.
The platform covers the full assessment workflow:
Configurable vendor questionnaires. No-code questionnaire workflows that send, chase, and score vendor responses automatically. No spreadsheet management, no manual chasing.
OSINT and adverse media intelligence. Automated searches across 600Bn+ archived web pages, court records, corporate registries, global sanctions and PEP databases, and social media. Coverage in 40+ native languages. Findings are delivered in a structured risk report, not a raw data dump.
Human analyst layer. For high-risk or sensitive assessments, Neotas analyst teams produce investigative reports that go beyond automated screening. This layer surfaces the discrepancies that automated tools miss.
Continuous monitoring. Real-time alerts on material changes across your entire third-party portfolio. Sanctions hits, adverse media, ownership changes, and financial distress signals are surfaced as they occur.
Regulatory-aligned outputs. Every assessment produces a time-stamped, auditable report structured to meet OCC, FFIEC, FCA FG 18/5, and ISO 27001 audit requirements.
Neotas is the Chartis FCC50 winner for Emerging Use Case: Know Your Third Party and Vertical and Segment Excellence: Supply Chain.
The Neotas VDDQ covers all six risk categories in one structured document. Risk and compliance teams at financial institutions, PE firms, and regulated businesses use it to collect consistent, comparable vendor information at onboarding and periodic review. The questionnaire includes: corporate and ownership information (including UBO), cybersecurity controls and certifications, data handling and privacy, business continuity and disaster recovery, subcontractor and fourth-party dependencies, and ESG policies.
A third-party risk assessment is a structured evaluation of the risks that a vendor, supplier, contractor, or partner introduces to your organisation. It covers cybersecurity, financial stability, regulatory compliance, operational resilience, reputational exposure, and ESG practices. The assessment produces a documented risk tier and a decision on whether to onboard, apply enhanced monitoring, or decline the relationship.
Vendor due diligence is the verification and investigation component of a third-party risk assessment. It refers to the process of checking what a vendor says against independent sources. A complete third-party risk assessment incorporates due diligence findings alongside risk scoring, a documented decision, and an ongoing monitoring plan.
The process runs in seven steps: classify the vendor by risk tier, collect structured information through a vendor questionnaire, verify responses against independent sources (corporate registries, sanctions databases, OSINT), score inherent risk, assess controls and score residual risk, document the risk decision, and set an ongoing monitoring cadence. Each step must produce a retrievable record for regulatory and audit purposes.
The six categories are cybersecurity and data privacy risk, regulatory and compliance risk, financial stability risk, operational and business continuity risk, reputational risk, and ESG and ethical risk. A complete assessment addresses all six. Missing any category leaves gaps that regulators and auditors will identify.
High-risk vendors require reassessment at least annually, with continuous monitoring between formal reviews. Standard-risk vendors warrant annual or biennial assessment. OCC Bulletin 2023-17 and FFIEC guidance require documented periodic reassessment for all critical third parties. One-time onboarding assessments are not sufficient.
No. Regulators including the OCC and FCA are explicit that questionnaire-only assessments do not meet due diligence standards. Independent verification against external sources is required. This includes corporate registries, court records, sanctions and PEP databases, adverse media, and open-source intelligence. FCA FG 18/5 specifically recommends internet-based OSINT checks as best practice.
Inherent risk is the raw level of risk a vendor introduces before any of their controls are considered. It is based on data sensitivity, service criticality, and regulatory exposure. Residual risk is what remains after reviewing and verifying the vendor’s controls, certifications, and track record. Risk decisions are based on residual risk, not inherent risk.
The primary US frameworks are OCC Bulletin 2023-17 for national banks and federal savings associations, FFIEC guidance on outsourcing technology services, NIST SP 800-161 for supply chain risk management, and FDIC guidance for state non-member banks. Financial institutions must demonstrate documented assessments and ongoing oversight to satisfy examination requirements.
Fourth-party risk is the risk introduced by your vendor’s vendors: the subcontractors and suppliers your third parties rely on. If a critical subcontractor has a data breach or becomes insolvent, that risk passes through to your organisation even though you have no direct contract with them. A complete third-party risk assessment identifies key subcontractor dependencies and assesses their risk profile.
OSINT (open-source intelligence) is the process of gathering and analysing information from publicly available sources including news archives, court records, corporate filings, social media, and web content. It surfaces reputational risk, adverse media, and ownership discrepancies that structured database checks miss. Neotas searches 600Bn+ archived web pages and 40,000+ media sources in 40+ languages, covering content that standard due diligence databases do not index.
A third-party cyber risk assessment is a focused evaluation of the cybersecurity posture of vendors and suppliers. It covers access controls, vulnerability management, incident response capability, data protection practices, and certifications such as SOC 2 and ISO 27001. It forms one component of a broader third-party risk assessment but can be conducted as a standalone exercise for technology and data vendors where cyber risk is the primary concern.
Most vendor risk platforms rely on questionnaires and structured database screening. Neotas adds OSINT coverage across 600Bn+ archived web pages, 1.8Bn+ court records, and 40,000+ media sources in 40+ languages, plus a human analyst layer for high-risk cases. The platform produces FCA and OCC-aligned audit outputs and supports continuous monitoring across the full vendor portfolio, not only point-in-time assessments.
Timeline depends on vendor complexity and risk tier. A simplified assessment for a low-risk vendor using automated screening completes in hours. A standard assessment covering questionnaire review and database checks takes 3 to 5 business days. An enhanced due diligence assessment for a high-risk vendor, including OSINT investigation and human analyst review, takes 5 to 10 business days. Neotas platform clients complete standard assessments in under 3 business days on average.
The Neotas Vendor Due Diligence Questionnaire (VDDQ) is a free, structured questionnaire that covers all six third-party risk categories: corporate and ownership information, cybersecurity controls, data handling, business continuity, subcontractor dependencies, and ESG compliance. It is designed for risk and compliance teams to collect consistent, comparable vendor data at onboarding and periodic review. Download it free from this page.
Tags: Third-Party Risk Management Policy, TPRM Policy Template, Vendor Risk Management Framework, Due Diligence Policy, Supply Chain Risk Governance, TPRM Best Practices, TPRM KPIs, TPRM Implementation, ESG in TPRM, Cybersecurity Risk Management, Fourth-Party Risk Oversight, Regulatory Compliance (DORA, NIS2, OCC, FCA).
Neotas Enhanced Due Diligence covers 600Bn+ Archived web pages, 1.8Bn+ court records, 198M+ Corporate records, Global Social Media platforms, and more than 40,000 Media sources from over 100 countries to help you screen & manage risks.
Get the free VDDQ covering all 6 risk categories. Built for financial institutions, PE firms, and compliance teams with no time to waste.
Table of Contents
vendor risk assessment template
vendor risk assessment template xls
vendor risk assessment questionnaire template
vendor risk assessment template excel
vendor management risk assessment template
bank vendor risk assessment template
free vendor risk assessment template
vendor risk management assessment template
third-party vendor risk assessment template
thirdparty vendor risk assessment template
vendor risk assessment questionnaire template pdf
free vendor risk assessment questionnaire template
vendor risk assessment template equation
vendor risk assessment questionnaire template excel
it vendor risk assessment template excel
vendor risk assessment template pdf
third party vendor risk assessment template
vendor risk assessment template – excel
soc 2 vendor risk assessment template
vendor risk assessment report template
it vendor risk assessment template
free vendor risk assessment template xls
vendor risk assessment template free
vendor risk assessment template xls excel
vendor risk assessment software
customer and vendor risk assessment software
software for vendor risk assessment
compare vendor risk assessment software solutions
vendor risk assessment
vendor management risk assessment
vendor risk assessment software
vendor security risk assessment
vendor risk assessment tools
vendor risk assessment template
automated vendor risk assessment
vendor risk assessment process
3rd party vendor risk assessment
third party vendor risk assessment
customer and vendor risk assessment software
vendor risk assessment checklist
vendor risk assessment questionnaire
information security vendor risk assessment
vendor risk assessment report
vendor risk assessment matrix
third party vendor risk assessment example
risk assessment third party vendor
vendor risk assessment criteria
hipaa vendor risk assessment
vendor cyber risk assessment
vendor risk assessment for banks
vendor risk assessment example
what is vendor risk assessment
vendor risk assessment tool
vendor risk assessment template xls
risk assessment for vendor management
vendor risk assessment questionnaire pdf
nist vendor risk assessment questionnaire
vendor financial risk assessment
vendor risk assessment services
ai vendor risk assessment
what is a vendor risk assessment
vendor due diligence risk assessment
vendor risk assessment policy
how to perform vendor risk assessment
vendor risk assessment program
vendor risk assessment procedure
vendor risk assessment questionnaire template
vendor management risk assessment questionnaire
vendor management risk assessment matrix
vendor risk management assessment matrix
nist vendor risk assessment
vendor risk assessment template excel
vendor risk assessment framework
vendor information security risk assessment
vendor risk assessment servicenow
vendor management risk assessment template
bank vendor risk assessment template
free vendor risk assessment template
risk assessment vendor selection
health risk assessment vendor
healthcare vendor risk assessment
vendor risk assessment form
vendor risk assessment questionnare
vendor risk assessment questions
risk assessment vendor management
vendor risk management assessment template
vendor risk assessment jobs
bank vendor management risk assessment
risk assessment for vendor qualification
vendor risk assessment checklist xls
sample vendor risk assessment
compare vendor risk assessment tools using ai for public procurement contracts.
third-party vendor risk assessment
vendor risk assessment library
vendor risk assessment resume
vendor risk assessment definition
third-party vendor risk assessment template
thirdparty vendor risk assessment template
vendor management risk assessment sample
risk assessment thirdparty vendor
vendor cybersecurity risk assessment
continuous vendor risk assessment
third party vendor risk assessment questionnaire
vendor qualification risk assessment
vendor risk assessment pdf
third-party vendor risk assessment example
vendor risk assessment tools ai public procurement contracts
social media archive services this vendor can also provide risk assessment monitoring
vendor risk assessment best practices
thirdparty vendor risk assessment example
vendor risk assessment scorecard
vendor management risk assessment
vendor risk assessment report sample
vendor risk management assessment
vendor risk assessment audits
cbanc network vendor management risk assessment
vendor risk assessment, reasonable security
vra vendor risk assessment
vendor risk assessment tools tech vendor credibility
vendor risk assessment questionnaire template pdf
sample vendor risk assessment questionnaire
free vendor risk assessment questionnaire template
what is vendor risk assessment process?
vendor risk assessment template equation
vendor risk assessment (vra)
vendor risk assessment process steps
vendor risk assessment methodology
how to do a vendor risk assessment
vendor management risk assessment
risk assessment for vendor management
vendor management risk assessment questionnaire
vendor management risk assessment matrix
vendor risk management assessment matrix
vendor management risk assessment template
risk assessment vendor management
vendor risk management assessment template
bank vendor management risk assessment
vendor management risk assessment sample
vendor management risk assessment
vendor risk management assessment
network vendor management risk assessment
vendor risk management business risk assessment
vendor management risk assessment
risk assessment for vendor management
vendor management risk assessment questionnaire
vendor management risk assessment matrix
vendor risk management assessment matrix
vendor management risk assessment template
risk assessment vendor management
vendor risk management assessment template
bank vendor management risk assessment
vendor management risk assessment sample
vendor management risk assessment
vendor risk management assessment
network vendor management risk assessment
vendor risk management business risk assessment vendor management risk assessment
risk assessment for vendor management
vendor management risk assessment questionnaire
vendor management risk assessment matrix
vendor risk management assessment matrix
vendor management risk assessment template
risk assessment vendor management
vendor risk management assessment template
bank vendor management risk assessment
vendor management risk assessment sample
ffiec vendor management risk assessment
vendor risk management assessment
vendor management risk assessment
vendor risk management business risk assessment
vendor risk assessment
vendor management risk assessment
vendor risk assessment software
vendor security risk assessment
vendor risk assessment tools
vendor risk assessment template
automated vendor risk assessment
vendor risk assessment process
3rd party vendor risk assessment
third party vendor risk assessment
customer and vendor risk assessment software
vendor risk assessment checklist
vendor risk assessment questionnaire
information security vendor risk assessment
vendor risk assessment report
vendor risk assessment matrix
third party vendor risk assessment example
risk assessment third party vendor
vendor risk assessment criteria
hipaa vendor risk assessment
vendor cyber risk assessment
vendor risk assessment for banks
vendor risk assessment example
what is vendor risk assessment
vendor risk assessment tool
vendor risk assessment template xls
risk assessment for vendor management
vendor risk assessment questionnaire pdf
nist vendor risk assessment questionnaire
vendor financial risk assessment
vendor risk assessment services
ai vendor risk assessment
what is a vendor risk assessment
vendor due diligence risk assessment
vendor risk assessment policy
how to perform vendor risk assessment
vendor risk assessment program
vendor risk assessment procedure
vendor risk assessment questionnaire template
vendor management risk assessment questionnaire
vendor management risk assessment matrix
vendor risk management assessment matrix
nist vendor risk assessment
vendor risk assessment template excel
vendor risk assessment framework
vendor information security risk assessment
vendor risk assessment
vendor management risk assessment template
bank vendor risk assessment template
free vendor risk assessment template
An advanced Due Diligence Platform that leverages AI to join the dots between Social Media, Corporate Records, Adverse Media and Open Source Intelligence (OSINT).
Our platform offers the most advanced insights, so you can respond to risks immediately.
With insights spanning global jurisdictions, your business is never in the dark.
Whether you manage a small portfolio or a global enterprise, our platform adapts to your needs
Ready to Transform Your Third-Party Risk Approach?
