What is a vendor risk assessment template?

A vendor risk assessment template is a standardised questionnaire and scoring framework used to evaluate a vendor's risk posture across multiple domains — cybersecurity, financial health, operational resilience, regulatory compliance, and ESG — and produce a composite risk score and tier classification.

How do you score a vendor risk assessment?

Score vendor risk assessments by assigning weighted scores to questionnaire responses (0–3 per question), applying domain weights based on vendor type (cybersecurity weighted higher for technology vendors), combining with external data scores (D&B, BitSight), and calculating a composite score. Scores above a defined threshold trigger enhanced review or risk treatment planning.

What is a vendor risk register?

A vendor risk register is a structured document or database record that captures identified risks for each vendor — the risk description, domain, inherent risk level, mitigating controls, residual risk level, risk owner, treatment decision, and review date. It is the primary evidence document for your TPRM programme.

How often should vendor risk assessments be updated?

Tier 1 (critical) vendors: annual formal reassessment plus continuous monitoring. Tier 2: annual reassessment. Tier 3: every 2–3 years. Triggered reassessment for any vendor following: a significant security incident, ownership or leadership change, material expansion of data access, or a regulatory enforcement action.

Vendor Risk Assessment Template: Free Framework & Scoring Guide 2026

☰ Contents

5-Domain Assessment Framework
Scoring Methodology
Sample Questionnaire Items by Domain
Vendor Risk Register Structure
Risk Threshold Definitions

5-Domain Vendor Risk Assessment Framework

A rigorous vendor risk assessment evaluates five distinct risk domains. Domain weights should be adjusted based on vendor type — technology vendors receive higher cybersecurity weighting; manufacturing suppliers receive higher operational resilience weighting.

Domain	Default Weight	Increase Weight For	Key Questions
Cybersecurity & Data Privacy	30%	Technology, SaaS, data-access vendors	SOC 2 status, security questionnaire score, cyber risk rating, DPA execution
Financial & Operational	25%	Sole-source, critical-path vendors	D&B score, revenue concentration, BCP maturity, key person risk
Regulatory & Compliance	20%	Healthcare, financial services, government	Licence status, enforcement history, HIPAA/FCPA compliance
Reputational & ESG	15%	High-profile, consumer-facing vendors	Adverse media, modern slavery, environmental policy, labour practices
Geopolitical & Concentration	10%	Manufacturing, direct materials	Primary country, alternative supplier availability, geographic concentration

Scoring Methodology

Question-Level Scoring (0–3 Scale)

Score	Meaning	Example Response
3 — Low Risk	Best practice; fully documented; externally verified	SOC 2 Type II report current, issued by Big 4 auditor
2 — Moderate Risk	Adequate; documented but not externally verified	Internal security policy exists; not independently audited
1 — Elevated Risk	Partial or informal; gaps identified	No formal policy; relies on individual judgement
0 — High Risk	Missing; non-compliant; or unable to evidence	No response provided; explicitly non-compliant

Composite Score Calculation

Composite Risk Score = Σ (Domain Score × Domain Weight). Domain Score = Average of all question scores within the domain × 33.3 (to produce a 0–100 scale). Combine the questionnaire composite score with external data scores (D&B, BitSight) using a 70/30 split: 70% questionnaire responses, 30% external data.

💡 Automation Note

Manual risk scoring from questionnaire responses takes 2–4 hours per vendor. Automated VRM platforms score questionnaire responses in real time as vendors complete the portal — reducing analyst review time to 20–30 minutes for standard assessments.

Sample Questionnaire Items by Domain

Cybersecurity Domain — Sample Questions

› Does your organisation have a current SOC 2 Type II report? (If yes, provide report)
› What is your organisation's vulnerability management cycle — time from vulnerability identification to patching for critical CVEs?
› Do all employees with access to customer data complete annual security awareness training?
› Does your organisation use multi-factor authentication for all remote access?
› What is your incident response notification commitment in the event of a breach affecting our data?

Financial Domain — Sample Questions

› What percentage of your annual revenue comes from your single largest customer?
› Has your organisation filed for bankruptcy or restructuring in the past 5 years?
› Does your organisation carry cyber liability insurance? What is the coverage limit?
› Do you have a documented business continuity plan that has been tested in the past 12 months?

Compliance Domain — Sample Questions

› Has your organisation been subject to any regulatory enforcement action in the past 5 years?
› Does your organisation have a documented anti-bribery and FCPA compliance programme?
› Does your organisation operate under any export control licences (EAR/ITAR)?
› Who is your organisation's designated privacy officer and what is their reporting line?

🚀 Free Executive Demo

Automate Risk Assessments with Procurement VMS

Join US procurement leaders who replaced manual processes with intelligent automation. Live in 4–8 weeks.

Request Your Executive Demo → Calculate Your ROI

🔒 SOC 2 Type II ⚡ Live in 4–8 Weeks 🇺🇸 US-Based Support

Vendor Risk Register Structure

Field	Description	Example
Vendor Name	Legal entity name	Acme Cloud Services, Inc.
Vendor ID	Unique identifier in vendor master	VND-004821
Risk Domain	Which of the 5 domains	Cybersecurity
Risk Description	Specific risk identified	No SOC 2 report; self-attested security only
Inherent Risk Level	Risk before controls (High/Medium/Low)	High
Mitigating Controls	Controls in place that reduce inherent risk	Annual security questionnaire; contractual audit rights
Residual Risk Level	Risk after controls (High/Medium/Low)	Medium
Risk Owner	Named individual accountable for this risk	Jane Smith, IT Security Manager
Treatment Decision	Accept / Mitigate / Transfer / Avoid	Mitigate — require SOC 2 within 12 months
Treatment Due Date	Deadline for treatment implementation	Dec 31, 2026
Next Review Date	When risk will be formally re-assessed	Jan 15, 2027

Risk Threshold Definitions

Score Range	Risk Level	Required Action
85–100	Low Risk	Approve; standard annual monitoring
70–84	Moderate Risk	Approve with documented acceptance; flag for enhanced monitoring
50–69	Elevated Risk	Approve only with documented treatment plan and owner assignment
30–49	High Risk	Hold pending treatment; escalate to CPO and Legal
0–29	Critical Risk	Do not approve; escalate to executive team; consider relationship termination

Related Resources

→ Vendor Risk Management Complete Guide → 50-Point Due Diligence Checklist → Vendor Compliance Management → Vendor Scorecard Template → Vendor Onboarding Guide