What is a vendor risk assessment template?

A vendor risk assessment template is a standardised questionnaire and scoring framework used to evaluate a vendor's risk posture across multiple domains, cybersecurity, financial health, operational resilience, regulatory compliance, and ESG, and produce a composite risk score and tier classification.

How do you score a vendor risk assessment?

Score vendor risk assessments by assigning weighted scores to questionnaire responses (0 to 3 per question), applying domain weights based on vendor type (cybersecurity weighted higher for technology vendors), combining with external data scores (D&B, BitSight), and calculating a composite score. Scores above a defined threshold trigger enhanced review or risk treatment planning.

What is a vendor risk register?

A vendor risk register is a structured document or database record that captures identified risks for each vendor, the risk description, domain, inherent risk level, mitigating controls, residual risk level, risk owner, treatment decision, and review date. It is the primary evidence document for your TPRM programme.

How often should vendor risk assessments be updated?

Tier 1 (critical) vendors: annual formal reassessment plus continuous monitoring. Tier 2: annual reassessment. Tier 3: every 2 to 3 years. Triggered reassessment for any vendor following: a significant security incident, ownership or leadership change, material expansion of data access, or a regulatory enforcement action.

Vendor Risk Assessment Template: Free Framework and Scoring Guide 2026

By Procurement VMS Editorial TeamLast updated June 1, 2026

A structured risk assessment template ensures every vendor is evaluated consistently, with the right questions, the right scoring methodology, and a clear risk register that satisfies auditors and regulators. Here is the complete framework.

Updated June 2026 11 min read Free Download Available Scoring Methodology Included

Request Your Executive Demo

Contents

5-Domain Assessment Framework
Scoring Methodology
Sample Questionnaire Items by Domain
Vendor Risk Register Structure
Risk Threshold Definitions

5-Domain Vendor Risk Assessment Framework

A rigorous vendor risk assessment evaluates five distinct risk domains. Domain weights should be adjusted based on vendor type, technology vendors receive higher cybersecurity weighting; manufacturing suppliers receive higher operational resilience weighting.

Domain	Default Weight	Increase Weight For	Key Questions
Cybersecurity and Data Privacy	30%	Technology, SaaS, data-access vendors	SOC 2 status, security questionnaire score, cyber risk rating, DPA execution
Financial and Operational	25%	Sole-source, critical-path vendors	D&B score, revenue concentration, BCP maturity, key person risk
Regulatory and Compliance	20%	Healthcare, financial services, government	Licence status, enforcement history, HIPAA/FCPA compliance
Reputational and ESG	15%	High-profile, consumer-facing vendors	Adverse media, modern slavery, environmental policy, labour practices
Geopolitical and Concentration	10%	Manufacturing, direct materials	Primary country, alternative supplier availability, geographic concentration

Scoring Methodology

Question-Level Scoring (0 to 3 Scale)

Score	Meaning	Example Response
3, Low Risk	Best practice; fully documented; externally verified	SOC 2 Type II report current, issued by Big 4 auditor
2, Moderate Risk	Adequate; documented but not externally verified	Internal security policy exists; not independently audited
1, Elevated Risk	Partial or informal; gaps identified	No formal policy; relies on individual judgement
0, High Risk	Missing; non-compliant; or unable to evidence	No response provided; explicitly non-compliant

Composite Score Calculation

Composite Risk Score = Σ (Domain Score × Domain Weight). Domain Score = Average of all question scores within the domain × 33.3 (to produce a 0 to 100 scale). Combine the questionnaire composite score with external data scores (D&B, BitSight) using a 70/30 split: 70% questionnaire responses, 30% external data.

Automation Note

Manual risk scoring from questionnaire responses takes 2 to 4 hours per vendor. Automated VRM platforms score questionnaire responses in real time as vendors complete the portal, reducing analyst review time to 20 to 30 minutes for standard assessments.

Sample Questionnaire Items by Domain

Cybersecurity Domain, Sample Questions

› Does your organisation have a current SOC 2 Type II report? (If yes, provide report)
› What is your organisation's vulnerability management cycle, time from vulnerability identification to patching for critical CVEs?
› Do all employees with access to customer data complete annual security awareness training?
› Does your organisation use multi-factor authentication for all remote access?
› What is your incident response notification commitment in the event of a breach affecting our data?

Financial Domain, Sample Questions

› What percentage of your annual revenue comes from your single largest customer?
› Has your organisation filed for bankruptcy or restructuring in the past 5 years?
› Does your organisation carry cyber liability insurance? What is the coverage limit?
› Do you have a documented business continuity plan that has been tested in the past 12 months?

Compliance Domain, Sample Questions

› Has your organisation been subject to any regulatory enforcement action in the past 5 years?
› Does your organisation have a documented anti-bribery and FCPA compliance programme?
› Does your organisation operate under any export control licences (EAR/ITAR)?
› Who is your organisation's designated privacy officer and what is their reporting line?

Free Executive Demo

Automate Risk Assessments with Procurement VMS

Join US procurement leaders who replaced manual processes with intelligent automation. Live in 4 to 8 weeks.

Request Your Executive Demo Calculate Your ROI

SOC 2 Type II Live in 4 to 8 Weeks US-Based Support

Vendor Risk Register Structure

Field	Description	Example
Vendor Name	Legal entity name	Acme Cloud Services, Inc.
Vendor ID	Unique identifier in vendor master	VND-004821
Risk Domain	Which of the 5 domains	Cybersecurity
Risk Description	Specific risk identified	No SOC 2 report; self-attested security only
Inherent Risk Level	Risk before controls (High/Medium/Low)	High
Mitigating Controls	Controls in place that reduce inherent risk	Annual security questionnaire; contractual audit rights
Residual Risk Level	Risk after controls (High/Medium/Low)	Medium
Risk Owner	Named individual accountable for this risk	Jane Smith, IT Security Manager
Treatment Decision	Accept / Mitigate / Transfer / Avoid	Mitigate, require SOC 2 within 12 months
Treatment Due Date	Deadline for treatment implementation	Dec 31, 2026
Next Review Date	When risk will be formally re-assessed	Jan 15, 2027

Risk Threshold Definitions

Score Range	Risk Level	Required Action
85 to 100	Low Risk	Approve; standard annual monitoring
70 to 84	Moderate Risk	Approve with documented acceptance; flag for enhanced monitoring
50 to 69	Elevated Risk	Approve only with documented treatment plan and owner assignment
30 to 49	High Risk	Hold pending treatment; escalate to CPO and Legal
0 to 29	Critical Risk	Do not approve; escalate to executive team; consider relationship termination

Related Resources

to Vendor Risk Management Complete Guide to 50-Point Due Diligence Checklist Vendor Compliance Management to Vendor Scorecard Template to Vendor Onboarding Guide