Template
Vendor Due Diligence Assessment Checklist
A nine-step review across three parts, from scope and screening through control validation to a scored, signed recommendation.
An editable 22-page package for checking vendor claims against evidence. Every step names its goal, the actions, the questions to ask, the common mistake to avoid, and what done looks like.
What’s inside
- A readiness page capturing vendor, product or service, tier, reviewer, business owner, review date, target decision date and GRC record link, with the inputs, stakeholders, systems and a planning estimate by tier
- A nine-step workflow from confirming scope and sanctions screening through reading the SOC 2 Type 2 report properly, control validation, privacy and AI review and resilience to scoring and remediation tracking
- An 11-domain control validation questionnaire setting the minimum acceptable evidence against a Validated, Partial or Gap status, with a probe question for each
- A weighted residual-risk scorecard across six domains with recommendation bands, and a SOC 2 Type 2 reading checklist
- A 12-section report framework, a findings register, evidence and reviewer checklists, a red-flag table and the final sign-off block
The decision gate is explicit: no approval while material evidence is pending, a High finding has no remediation plan, or a red flag is unresolved. Score bands map straight to the outcome, from Approve at 4.5 or more to Reject below 2.5, and a conditional approval carries owned, dated remediation that is tracked weekly until it closes.