Free TPRM Resource
Vendor Risk Assessment Checklist Template for TPRM Analysts
A practical, 147-question workflow to assess vendors, capture evidence, score risk, and make defensible decisions — covering intake through offboarding across six structured stages.
Why most vendor assessments stall
Third-party risk management programs often break down not at the policy layer but at execution. Analysts receive inconsistent questionnaire responses, chase missing evidence for weeks, and produce assessment records that won't survive an audit. The core problem: there's no agreed-upon workflow that moves a vendor from intake to a defensible risk decision.
What this checklist covers
The checklist structures 147 analyst questions across six sequential stages. Each stage includes evidence requests, scoring fields, decision criteria, and follow-through actions — combining the analyst's working document, the evidence tracker, and the risk scoring sheet in one file.
- Stage 1 — Intake & Scoping Data sensitivity, access scope, business criticality, and AI use flags that determine review depth.
- Stage 2 — Due Diligence Security certifications, penetration test reports, SOC 2 coverage, and subprocessor chains.
- Stage 3 — Assessment Control-by-control evaluation with evidence fields, analyst observations, and gap ratings.
- Stage 4 — Remediation Gap owners, deadlines, compensating controls, and contract clause requirements.
- Stage 5 — Monitoring Evidence refresh schedules, review triggers, and continuous-monitoring signal integration.
- Stage 6 — Offboarding Access revocation, data deletion verification, transition obligations, and closure evidence.
What a completed checklist produces
A completed checklist becomes a defensible assessment record: defined scope, linked evidence, scored findings, decision rationale, approved exceptions, a treatment plan, contract actions, a monitoring cadence, and closure evidence. Complete it digitally or print the section tables for interviews and workshops. The worked ACME example included in the PDF shows every field populated for a realistic mid-tier SaaS vendor.
Dedicated AI and GenAI due diligence
Stage 3 includes a dedicated AI and GenAI section covering vendor AI use, training data handling, human oversight mechanisms, agentic action scope, red-teaming practices, incident history, and model-provider dependencies. These questions align with emerging regulatory expectations under the EU AI Act and NIST AI RMF.
Included in the download
Free TPRM Resource
Vendor Risk Assessment
Checklist Template
SAFE Security
safe.security
Checklist Stages
- 1.1 Identify data categories and sensitivity classification
+ 144 more questions
Get the complete checklist
147 questions across six stages. Enter your business email to receive the complete PDF.