Procurement Supplier Risk Assessment Template

This product includes both a full vendor onboarding risk questionnaire and a condensed quick vendor assessment questionnaire, giving you two practical options depending on the vendor’s risk level and the depth of due diligence required.

The full vendor onboarding risk questionnaire is ideal for medium-, high-, and critical-risk vendors, including SaaS providers, cloud vendors, managed service providers, AI-enabled platforms, data processors, technology suppliers, and vendors with system access. It includes a detailed vendor profile, automated risk dashboard, scoring model, evidence review fields, risk treatment logic, approval guidance, and a comprehensive questionnaire covering information security, privacy, legal, compliance, financial, operational resilience, subcontractor, AI, and exit risks.

The condensed vendor onboarding risk questionnaire is built for quick vendor screening and early-stage triage. It includes a simplified dashboard, 30 core risk questions, automated scoring, evidence checklist, and decision guidance to help determine whether a vendor can follow a simplified approval path or should be escalated to full due diligence.

These Excel templates are designed with reference to leading risk and governance frameworks, including ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 42001, ISO/IEC 23894, NIST Cybersecurity Framework, NIST SP 800-161, NIST AI Risk Management Framework, and CISA ICT Supply Chain Risk Management guidance.

What’s Included

• Full vendor onboarding risk questionnaire Excel workbook
• Condensed quick vendor assessment Excel workbook
• Automated vendor risk dashboard
• Vendor profile and inherent risk classification
• Detailed third-party risk questionnaire
• Quick 30-question vendor triage assessment
• Automated scoring model and risk-tier logic
• Evidence checklist and evidence-quality review
• Risk treatment and approval guidance
• Go-live readiness and escalation indicators
• Review cadence and ongoing monitoring support
• Questions covering security, privacy, legal, compliance, operational resilience, financial stability, AI governance, subcontractors, data protection, access control, and exit planning

Key Benefits

• Save time creating a vendor risk questionnaire from scratch
• Standardize vendor onboarding and due diligence reviews
• Identify high-risk vendors earlier in the procurement process
• Support ISO 27001 supplier risk management activities
• Include AI vendor risk considerations aligned with ISO 42001 principles
• Improve visibility into vendor data, access, privacy, security, and operational risks
• Support risk-based approval decisions and escalation paths
• Track evidence gaps, critical flags, remediation actions, and review cadence
• Use a quick assessment first, then escalate to full due diligence when needed

Best For

• Third-party risk management teams
• Procurement and vendor management teams
• Information security teams
• Privacy and data protection teams
• Compliance and legal teams
• IT risk and governance teams
• SaaS, cloud, technology, and AI vendor assessments
• Organizations building or improving a vendor onboarding process

Suggested Use

Use the condensed questionnaire for quick vendor pre-screening and low-risk vendor triage. Use the full questionnaire when the vendor processes sensitive or personal data, accesses systems or APIs, supports a critical business process, uses AI, relies on subcontractors, introduces regulatory exposure, or requires formal risk acceptance.

This template pack provides a practical, structured, and risk-based approach to vendor onboarding, helping organizations make better-informed decisions before entering into or expanding third-party relationships.