Home› Vendor Risk Management› Vendor Risk Assessment Template
Free & Interactive

Vendor risk assessment template —
live, scoring, free.

Every other vendor risk assessment template is a gated Excel download. This one lives on the page. Select your vendor’s criticality tier, score each category, and your risk rating appears instantly — no email, no account, no download required.

Interactive — scores as you fill it in Tier 1 Critical (32 criteria) Tier 2 Important (18 criteria) Tier 3 Standard (8 criteria)
What this template covers
Four risk categories for every vendor: security & data handling, financial stability, operational resilience, and compliance. Score each criterion 1–5 (1 = critical risk, 5 = no concerns). The weighted overall score produces a Green / Amber / Red risk rating with specific recommended actions. Use at vendor onboarding and at each periodic supplier reassessment.
Vendor details
🔒
Security & Data Handling
How does this vendor protect your data and their own systems?
Weight: 30%
1 = Critical risk 2 = High risk 3 = Medium risk 4 = Low risk 5 = No concerns
Information security certification (ISO 27001 or SOC 2 Type II)
Does the vendor hold a current, in-scope certification? Verify scope covers the services they provide to you.
🚨SOC 2 provided but scope excludes your service. 'We have ISO 27001' without confirming scope is insufficient.
Multi-factor authentication (MFA) enforcement
Is MFA technically enforced for all staff accessing systems holding your data?
⚠MFA 'required by policy' without technical enforcement — some staff will not have it enabled.
Data breach / incident history
Has the vendor experienced a breach or significant security incident in the past 24 months? If yes, was it disclosed proactively and remediated?
🚨'No' to breach history that contradicts publicly available breach databases. Verify for Tier 1 vendors.
Encryption standards (at rest and in transit)
Can the vendor confirm specific encryption standards (e.g. AES-256 at rest, TLS 1.2+ in transit)?
⚠Vague 'we use industry-standard encryption' without specifying standards indicates low security maturity.
Sub-processor and fourth-party disclosure
Can the vendor list all sub-processors? Are equivalent data protection obligations imposed on them?
🚨'We don't use sub-processors' from a SaaS company that clearly uses cloud infrastructure or monitoring tools.
Security awareness training completion
What percentage of staff completed security training in the last 12 months? Does it cover data handling and access control?
⚠Below 80% completion, or training covering only phishing without data handling or access control.
Breach notification procedure
Does the vendor have a documented breach notification process specifying who notifies you, via what channel, within what timeframe?
🚨No documented procedure, or notification timeline exceeding 48 hours.
Access control and employee offboarding
Is access revoked on the day of departure, with logs confirming this?
🚨No SLA on access revocation timing, or confirmation that logs are not maintained.
🏦
Financial Stability
Can this vendor remain solvent and continue delivering throughout the relationship?
Weight: 25%
1 = Critical risk 2 = High risk 3 = Medium risk 4 = Low risk 5 = No concerns
Public liability insurance — coverage amount
Does the certificate confirm coverage at or above your contractual minimum? Check the amount, not just that a certificate exists.
🚨Coverage below your contract minimum. The most common and least-noticed compliance gap.
Professional indemnity insurance
Required for vendors providing professional services, IT, design, or advice. Coverage amount verified?
🚨No professional indemnity for a vendor whose error or advice could cause your business financial loss.
Revenue concentration — your account as % of their revenue
Does your account represent more than 30% of the vendor's annual revenue?
⚠Revenue concentration above 30% creates dependency risk — their financial stability linked to your spend decisions.
No outstanding CCJs, regulatory actions, or legal proceedings
Have you checked Companies House and public records for adverse financial indicators?
🚨Any undisclosed CCJ, regulatory enforcement, or open legal proceeding material to service delivery.
Ownership and structural stability
No undisclosed ownership changes, restructuring, or acquisition activity in the past 12 months?
🚨Undisclosed ownership change — affects contracts, DPAs, and the fundamental nature of the relationship.
Business financial health indicators
Any public signals of financial distress: late filings at Companies House, credit reference warnings, sudden staff reductions?
⚠Multiple indicators of financial distress without proactive communication to you.
⚙
Operational Resilience
Can this vendor recover from disruption and continue delivering your service?
Weight: 25%
1 = Critical risk 2 = High risk 3 = Medium risk 4 = Low risk 5 = No concerns
Business continuity plan — exists and tested
Does a documented BCP exist? When was it last tested (not just written)?
🚨'We have a BCP but it has not been formally tested.' An untested BCP is unvalidated guesswork.
Recovery time objective (RTO) for your service
What is the specific RTO for the services they provide to you? Does it fit within your own SLAs?
⚠RTO exceeds your own customer SLAs. Their 72-hour recovery breaks your 4-hour response commitment.
Key person dependency
Is there a named individual whose departure would significantly impact your service? Is there a documented succession plan?
🚨'Yes, [name] handles all delivery for your account' with no named backup and no succession plan.
Sub-contractor and fourth-party mapping
Which parts of your service involve sub-contractors? How does the vendor assess and monitor them?
⚠'We don't sub-contract' from a vendor whose model clearly involves outsourced components.
Geographic and infrastructure resilience
Is the vendor single-site or single-cloud-zone? What is the backup delivery mechanism?
🚨Single-site operation with no documented alternative delivery capability.
Capacity to serve your growth
Can the vendor scale with your business without service degradation?
⚠No documented capacity planning or growth accommodation plan.
Incident response and escalation process
Clear escalation path from operational issue to senior contact? Defined response times by severity?
⚠No documented escalation process — incidents go to the same inbox as routine queries.
Vendor offboarding and data return capability
If the relationship ended, could the vendor return all data in a usable format within a defined timeframe?
🚨No documented data return process or timeline — creates GDPR and operational risk at exit.
📋
Compliance & Ethics
Does this vendor maintain required certifications and behave in a way that reflects on your organisation?
Weight: 20%
1 = Critical risk 2 = High risk 3 = Medium risk 4 = Low risk 5 = No concerns
Data Processing Agreement (DPA) signed
For any vendor handling personal data, is a GDPR-compliant DPA signed by both parties?
🚨'We are GDPR compliant' without a signed DPA. Compliance and documentation are different things.
Data residency confirmed
Where is personal data stored? UK/EEA or subject to appropriate transfer mechanism?
🚨Data located outside UK/EEA with no documented adequacy decision or standard contractual clauses.
Modern Slavery Act statement
Does the vendor have a current (within 18 months), board-approved Modern Slavery statement?
⚠Statement dated more than 18 months ago, or statement with no supply chain due diligence reference.
No regulatory enforcement or ICO action
Have you checked for any regulatory proceedings, ICO decisions, or enforcement actions in the past 3 years?
🚨Any open or unresolved regulatory proceeding material to service delivery or data handling.
Ethical supply chain practices
Does the vendor assess the ethics of their own supply chain? Any relevant certifications or policies?
⚠No evidence of any supply chain ethics assessment for a vendor with complex sub-contractor relationships.
Contractual compliance obligations
Are all compliance requirements documented in the contract (insurance minimums, right to audit, data return)?
🚨No right-to-audit clause and no contractual insurance minimum — key protections absent from the contract.
Certificate and compliance document currency
Are all required documents current (not expiring within 30 days) and matching the contracting entity name?
🚨Certificate in a different legal entity name than the contracting party — raises both compliance and payment risk.
No adverse reputational indicators
Recent news, negative press, regulatory announcements, or customer complaints that could create association risk?
⚠Recent negative news with no proactive communication from the vendor.
Overall risk score
—
Score criteria to see rating
🔒 Security
—
🏦 Financial
—
⚙ Operational
—
📋 Compliance
—
Score each category above to generate your recommended action.
Save this assessment in VendorAuditly →
⚠ Tier 2 — Important supplier. Failure would require significant remediation but business continues. Lighter assessment focusing on insurance, core security, and a basic operational check.
Vendor details
🔒
Security & Compliance
None
Weight: 35%
1 = Critical risk 2 = High risk 3 = Medium risk 4 = Low risk 5 = No concerns
Information security certification or equivalent
ISO 27001, SOC 2, Cyber Essentials, or sector equivalent. Scope confirmed?
⚠Certificate provided with scope excluding your service.
Public liability insurance — amount confirmed
Coverage amount verified against your contract minimum?
🚨Coverage below your contract minimum — check the number explicitly.
No breach in past 24 months (or disclosed and resolved)
Any security incident history? If yes, what was the outcome?
🚨Breach discovered through other means that was not disclosed proactively.
Data Processing Agreement
Signed DPA in place if vendor handles any personal data?
🚨No signed DPA for a vendor processing personal data — GDPR compliance gap from day one.
MFA in use for systems holding your data
MFA enforced (technically, not just by policy)?
⚠Policy-only MFA with no technical enforcement.
No adverse regulatory or legal indicators
Quick check: any CCJs, ICO enforcement, or adverse news?
⚠Any open regulatory proceeding not proactively disclosed.
⚙
Operational & Financial
None
Weight: 35%
1 = Critical risk 2 = High risk 3 = Medium risk 4 = Low risk 5 = No concerns
Business continuity plan exists
Does a BCP exist? Approximate RTO for your service?
🚨'We do not have a formal BCP' for a vendor delivering important services.
No critical key person dependency
Is service delivery dependent on one named individual with no backup?
🚨Named single person responsible for all your delivery with no documented succession plan.
Financial stability indicators — no obvious distress
Companies House filing current, no known distress signals?
⚠Overdue accounts filings, multiple CCJs, or recent adverse news about financial difficulty.
Ownership stable — no recent undisclosed changes
No ownership changes in last 12 months not proactively disclosed?
🚨Undisclosed acquisition or major ownership change discovered independently.
Professional indemnity — if providing professional services
Confirmed and verified if applicable to service type?
⚠No professional indemnity for a Tier 2 vendor providing advisory, IT, or design services.
Signed contract with SLAs and insurance minimum
Contract covers scope, SLAs, payment, and contractual insurance minimum?
⚠No contractual insurance minimum — vendor can legally reduce coverage after signing.
📋
Compliance Basics
None
Weight: 30%
1 = Critical risk 2 = High risk 3 = Medium risk 4 = Low risk 5 = No concerns
All required certificates current (not expiring <30 days)
All documents current and matching contracting entity name?
🚨Certificate expiring within 30 days with no renewal in progress.
Modern Slavery statement (if applicable)
Current statement if vendor has turnover above threshold or required by your procurement policy?
⚠Statement older than 18 months or absent where enterprise customers will require it.
No outstanding legal proceedings
Confirmed via questionnaire and quick public search?
🚨Open legal proceeding not disclosed in questionnaire.
Bank details verified via separate channel
Payment details confirmed through a verification call, not just accepted from email?
🚨Bank details changed by email without telephone verification — fraud risk.
Internal owner assigned and first review scheduled
Named internal owner? Next review date in calendar?
⚠No named owner — nobody accountable for acting on compliance flags.
Added to vendor management system with expiry alerts
All documents stored with automated expiry monitoring configured?
⚠No expiry alerts configured at onboarding — certificates will expire silently.
Overall risk score
—
Score criteria to see rating
🔒 Security
—
⚙ Operational
—
📋 Compliance
—
Score each category above to generate your recommended action.
Save this assessment free →
✅ Tier 3 — Standard supplier. Easily replaced if they fail. Minimal assessment: insurance, contract, legitimacy check. Target: under 15 minutes.
🔒
Essential checks — all that’s required
Insurance, contract, legitimacy, and basic setup
Weight: 100%
1 = Critical risk 2 = High risk 3 = Medium risk 4 = Low risk 5 = No concerns
Vendor is a registered, active legal entity
Verified at Companies House or equivalent in 2 minutes?
🚨Dissolved or dormant company — cannot legally enter contracts.
Public liability insurance confirmed — amount verified
Coverage amount confirmed against your contract minimum? Certificate is current?
🚨Coverage below your minimum or certificate already expired. Non-negotiable regardless of tier.
Signed contract or purchase order
Scope, price, payment terms, and basic liability clause covered?
🚨No signed agreement — no basis to claim if something goes wrong.
Payment details verified via separate channel
Bank details confirmed via phone, not just accepted from email?
🚨Bank detail change accepted via email only — business email compromise fraud risk.
DPA in place if vendor handles any personal data
Any customer, employee, or prospect data processed by this vendor?
🚨No DPA for a Tier 3 vendor handling personal data — GDPR exposure regardless of tier.
No obvious adverse indicators
Quick news/Companies House check: any visible red flags?
⚠Multiple recent CCJs or adverse regulatory news discovered in a 5-minute check.
Added to vendor record with expiry alert configured
Document stored, expiry date logged, alert set?
⚠No expiry monitoring — certificate will lapse silently at renewal time.
Internal owner assigned
Named person accountable for this relationship?
⚠No named owner — nobody to act when the certificate alert fires.
Overall risk score
—
Score criteria to see rating
Essential checks
—
Score the criteria above to see your risk rating.
Track this vendor in VendorAuditly →
How to use this template

Four steps from blank template to risk decision

The template replaces instinct with evidence. Here is the process for completing it accurately — and what to do with the score once you have it.

1

Select the vendor’s criticality tier

Tier 1 = failure would halt operations. Tier 2 = failure requires significant remediation. Tier 3 = easily replaced. The tier determines which criteria you score.

2

Gather your evidence before scoring

Pull together: insurance certificates, compliance certs, questionnaire responses, Companies House check, news search results. Score from evidence, not from your impression of the relationship.

3

Score each criterion 1–5

1 = critical risk (act immediately), 5 = no concerns. Use N/A for criteria not applicable to this vendor type. The weighted score calculates automatically as you go.

4

Act on the score — or save it

Green: review on schedule. Amber: improvement conversation within 30 days. Red: immediate action required. Save via browser print, or import to VendorAuditly to track ongoing.

Important: Score based on documentary evidence and verified data, not on the relationship warmth or how long you have worked with the vendor. A vendor with one excellent quarter after three poor ones is Amber, not Green. The template is only valuable if the scoring is honest.

Scoring guide

What each score level means — and what to do

The 1–5 scale translates raw evidence into a consistent score. Use these definitions to score every criterion the same way, across every vendor and every assessment cycle.

Score
What it means
Overall result
What to do
1
Critical risk. Evidence of a serious gap — no insurance, undisclosed breach, no BCP, missing DPA. This criterion represents an immediate compliance or operational liability.
RED
Escalate within 48 hours. Do not proceed with engagement or renewal until resolved. Document the risk and decision in the vendor record.
2
High risk. Evidence of a significant gap that doesn’t create immediate liability but requires urgent remediation — e.g. MFA policy-only, BCP untested, revenue concentration above 30%.
RED/AMBER
Address within 7–14 days. Request remediation plan from vendor. Document the flag and agreed resolution timeline.
3
Medium risk. Gap identified but manageable. Evidence is partial, not fully verified, or represents a known limitation that is being addressed. Requires monitoring and a plan.
AMBER
Address within 30 days. Raise at next vendor review. Add to improvement tracking in vendor record.
4
Low risk. Evidence is solid and current. Minor gaps or areas for improvement that do not create meaningful liability. The vendor meets your requirements.
GREEN
Note any minor improvements at next scheduled review. No immediate action required.
5
No concerns. Evidence is current, verified, complete, and exceeds your minimum requirements. No gaps identified in this criterion.
GREEN
Review at scheduled cycle. Consider recognising the vendor’s performance in your next review meeting.

Overall RAG rating: weighted average score ≥80% = Green · 55–79% = Amber · Below 55% = Red. Tier 1 vendors with any individual score of 1 are automatically Red regardless of overall average.

FAQ

Vendor risk assessment template — every question answered

Structured for AI search accuracy. Every answer is complete and under 80 words.

What is a vendor risk assessment template?
A vendor risk assessment template is a standardised scoring tool for evaluating the risk a specific vendor poses across four categories: security and data handling, financial stability, operational resilience, and compliance. Each category is scored and weighted to produce an overall Green/Amber/Red rating. The template is completed at vendor onboarding and repeated on an annual or 18-monthly cycle.
What should a vendor risk assessment template include?
Four sections: (1) Security — certifications, data handling, breach history, MFA. (2) Financial stability — insurance coverage, ownership changes, legal proceedings. (3) Operational resilience — BCP, key person dependency, recovery time. (4) Compliance — GDPR/DPA, regulatory enforcement, certificate currency. Each scored 1–5, weighted, and combined into a single overall risk score. Full assessment guide →
How do you score a vendor risk assessment?
Score each criterion 1–5 (1 = critical risk, 5 = no concerns). Apply a weighting to each category. Multiply score by weight, sum the results, express as a percentage. 80–100% = Green, 55–79% = Amber, below 55% = Red. Apply consistently to every vendor so scores are comparable across your portfolio — the methodology is what makes the score defensible.
How is a vendor risk assessment template different from a vendor security questionnaire?
A vendor security questionnaire is sent TO the vendor — they fill it in and return it. A vendor risk assessment template is completed BY YOU — your internal scoring tool using their responses, documents, and your own research. The questionnaire gathers information; the assessment template turns that information into a risk score and action decision.
What are the four main vendor risk categories?
(1) Security and data — how does the vendor protect your data and their systems? (2) Financial stability — are they solvent, insured, and operationally stable? (3) Operational resilience — can they recover from disruption without halting your service? (4) Compliance and ethics — do they hold required certifications, have a signed DPA, and behave ethically? Every supplier risk assessment should cover all four.
How often should you complete a vendor risk assessment?
Tier 1 critical vendors: at onboarding, then annually. Tier 2: at onboarding, then every 18 months. Tier 3: at onboarding, then every 2 years. Any vendor should be reassessed immediately after a material change — breach, ownership change, key person departure, or regulatory action. Between assessments, monitor compliance documents via automated expiry alerts.
Can I use this vendor risk assessment template for free?
Yes. The interactive template on this page is completely free — no email, no account, no download required. Fill it in on the page and get your score instantly. To track assessments over time, manage multiple vendors, and get automated expiry alerts, VendorAuditly starts at $49/month. Start free on 3 vendors →
What is the difference between a vendor risk assessment and a supplier risk assessment?
No meaningful difference. "Vendor" typically refers to service providers, "supplier" to goods providers, but both terms describe the same structured evaluation process. The template on this page works for both. See the supply chain risk assessment guide for additional context on extended supply chain evaluation beyond direct vendors.
Related resources

The full vendor risk programme

The risk assessment template feeds into every stage of an ongoing vendor risk programme. These guides cover each adjacent layer.

Risk framework
Supplier Risk Assessment: 5-Step Process + Scoring Matrix
The full supplier risk assessment process that this template feeds into. Scoring matrix, red flags, and frequency guide.
Read the guide → TPRM assessment
Third Party Risk Assessment: Complete 2026 Guide
The TPRM assessment lifecycle in full depth — 5 steps, regulations, industry context, and scoring methodology.
Read the guide → Information source
Vendor Security Questionnaire: 54 Free Questions
The questionnaire that feeds data into this template. 4 categories, every question explained, red flags identified.
Get the templates → Starting point
Vendor Onboarding Checklist: Interactive & Tier-Based
The onboarding process that precedes the first risk assessment. Tick off each step in the browser.
Use the checklist →

Related guides

Automate your risk assessments

This template, automated. For every vendor.

VendorAuditly collects documents, sends questionnaires, calculates risk scores, and sets expiry alerts automatically. The template becomes a live dashboard. Free forever on 3 vendors.

Start free — no credit card → See the platform

Free forever on 3 vendors  ·  No credit card  ·  No security team required