Third-Party Risk Assessment Template: The Essential 2026 Guide to Sections and Scoring

A third-party risk assessment template is a standard form that lets you evaluate every vendor, supplier and service provider the same way: how important they are, what data or systems they touch, how well they control their own risk, and what you will do about the gaps. It replaces ad hoc email questionnaires with something repeatable.

The need is practical. Most organizations depend on dozens or hundreds of providers, and a failure at one of them can become your outage, your breach or your regulatory problem. Without a template, each assessment looks different, and leaders cannot compare vendors or see the total exposure.

This guide lays out the sections a usable template needs, how to score them and what evidence to request. The example numbers are illustrative, so adjust them to your own context.

Why use a third-party risk assessment template

Vendor assessments tend to drift. One analyst sends a long questionnaire, another sends a short one, and a third skips the exercise because the vendor looked familiar. The result is inconsistent coverage and arguments about why one supplier was approved and another was not.

A single third-party risk assessment template fixes that by standardizing the questions, the scoring and the approvals. It gives procurement, security, legal and the business a shared view, and it leaves a dated record that regulators and customers can inspect.

It also scales. When the template drives the work, you can assign more of the routine reviews to junior staff and reserve senior time for the vendors that matter most.

Profile and tiering in a third-party risk assessment template

Open with a vendor profile: legal name, services provided, business owner, contract dates, locations, subcontractors and the data or systems the vendor can access. Keep it short, but make sure the business owner is named.

Then tier the vendor. A simple approach uses three levels. Tier one vendors are critical, handle sensitive data or would cause serious disruption if they failed. Tier two vendors have moderate access or impact. Tier three vendors are low-risk. Tiering decides how deep the assessment goes, so it saves effort where the risk is low. The method in vendor risk tiering gives example criteria.

Revisit tiering whenever the scope of a contract changes. A tool that started as a pilot can quietly become business-critical.

Section	Question it answers	Typical evidence
Profile	Who is the vendor and what do they do for us?	Contract, service description
Tier	How critical is this vendor?	Criticality rating
Due diligence	How well do they manage risk?	Policies, certificates, questionnaire
Scoring	How big is the remaining risk?	Inherent and residual score
Contract	Are protections written down?	Clauses, service levels, exit terms
Monitoring	What changes over time?	Reviews, incident notices

Due diligence questions and evidence

Group questions by area: information security, privacy, business continuity, financial stability, legal and regulatory compliance, and subcontractor management. For a tier one vendor, ask for evidence, not just answers. That could include an independent audit report, a penetration test summary, a recovery test result or a policy document.

Keep the questionnaire proportionate. A long generic form makes vendors copy and paste answers, which tells you little. Ask the questions that connect to the risk at hand, and follow up on inconsistencies.

NIST publishes guidance on managing supply chain risk in SP 800-161 Rev. 1, available at NIST SP 800-161 Rev. 1, which is a useful source when you design questions for technology suppliers.

Scoring vendor risk

Score each vendor on inherent risk, which is the exposure from the service itself, and residual risk after you consider the vendor’s controls. Use a simple one-to-five scale for likelihood and impact, multiplied to 25, with defined bands for low, medium and high.

For example, a payroll provider that holds employee bank details might have an inherent score of 20 because of data sensitivity and scale. If the provider holds a recent independent audit report, enforces strong access control and commits to breach notice, residual risk might fall to 9.

Write the reasoning beside each score. vendor risk scoring explains how to keep scores consistent across assessors, and the notes will matter when someone questions the decision months later.

Contract and exit checks

A strong assessment ends in the contract. Check that it contains security and privacy obligations, breach notification timing, audit rights, subcontractor controls, service levels and termination rights. The clause guidance in TPRM contract clauses lists the terms that usually matter most.

Plan for exit from the start. Ask how you would retrieve your data, how long a transition would take and what happens if the vendor fails. A written approach in vendor exit strategy turns this into a short document for critical suppliers.

Also look at concentration. If several critical services rely on the same provider or the same cloud region, a single failure has a larger effect, as vendor concentration risk explains.

Ongoing monitoring and reporting

Approval is not the end. Set a review frequency by tier: for example annual for tier one, every two years for tier two, and event-based for tier three. Add triggers for incidents, ownership changes, new subcontractors, expired certificates and service problems.

Use lightweight signals between reviews, such as certificate expiry dates, public incident news and service level reports. third-party continuous monitoring shows practical options without heavy tooling.

Report a few numbers to leadership: vendors by tier, overdue reviews, open findings and critical vendors with high residual risk. The format in third-party risk reporting keeps this to one page.

Using a ready-made third-party risk assessment template

Designing the structure takes longer than expected. You have to define tiers, write questions, build scoring and decide how to present findings. Starting from a finished structure shortens that path.

The Third-Party Risk Assessment Report covers vendor tiering, due diligence, risks, controls and a live workbook, so your team can record each vendor and see scores and findings in one place. Try it on five real vendors before you roll it out widely.

Whichever template you choose, agree the tier criteria and the approval rules with procurement, security and legal in advance. Disagreements are easier to settle before a contract is waiting for signature.

A worked third-party risk assessment template example

Consider a marketing email platform that stores customer names and email addresses for a retailer. Profile: a software-as-a-service provider, business owner in marketing, three-year contract. Tier: two, because the data is personal but not highly sensitive and the service could be replaced within weeks.

Due diligence: the vendor supplies an independent security audit report, a data processing agreement and a list of subprocessors. The reviewer notes that one subprocessor sits outside the region and that breach notice is promised within 72 hours. Inherent score 12, residual score 6 after controls and contract terms.

Decision: approve with conditions. The conditions are to confirm the transfer mechanism for the out-of-region subprocessor and to add a right to audit at renewal. Owner: privacy lead. Due: 30 days. Every step is recorded in the third-party risk assessment template, so the decision can be defended later. The details here are invented for illustration.

Setting approval rules for the third-party risk assessment template

Decide in advance who can approve what. Tier three vendors might be approved by the business owner with a short check. Tier two could need security and privacy sign-off. Tier one should reach a senior risk forum, with any high residual risk accepted by a named executive in writing.

Set service targets, too. If procurement waits three weeks for an assessment, the business will work around the process. A five-day target for tier three and fifteen for tier one is realistic for many teams, provided the template is ready and vendors respond on time.

Finally, record exceptions. Sometimes a vendor is used before it is assessed. Log the exception, the reason and the date by which the assessment will be completed, so nothing remains open indefinitely.

Keeping records audit-ready

Store each completed form, the evidence received and the approval in one place, with the vendor name and date in the file name. Auditors usually sample a handful of vendors and ask to see the full trail from tiering to approval.

Common mistakes with a third-party risk assessment template

The first mistake is treating every vendor the same, which either overloads the team or under-examines the critical ones. The second is accepting certificates without reading scope: a certificate that covers one data center may not cover the service you use.

The third is forgetting fourth parties, meaning the vendor’s own subcontractors. The fourth is leaving findings without owners or dates. The fifth is reviewing only at onboarding and never again.

Finally, do not let the template replace judgment. It supports decisions, and a thoughtful reviewer should still challenge a score that looks wrong.

Third-party risk assessment template FAQ

What should a third-party risk assessment template include?

It should include a vendor profile, tier, due diligence questions, evidence, scoring, contract checks, findings and a monitoring plan.

How is it different from a vendor questionnaire?

A questionnaire is one input. The template wraps it with tiering, scoring, contract review and follow-up so the whole process is consistent.

How many tiers should we use?

Three is a common, workable number. More tiers add complexity without improving decisions for most organizations.

How often should vendors be reassessed?

By tier: typically annually for critical vendors, less often for lower tiers, and immediately after a major incident or change.

Does a vendor certificate replace an assessment?

No. A certificate is evidence, but you must check its scope, date and exceptions and confirm it covers the service you use.