A vendor risk assessment checklist is the list of steps and evidence a program uses to decide whether a vendor's risk is acceptable. It starts with scoping and tiering, then requests evidence matched to the vendor's tier, reviews that evidence for scope, dates and exceptions, tracks findings to closure, and ends with a recorded sign-off.
A checklist keeps assessments consistent across analysts and years, and gives internal audit and examiners a clear trail. Below is a practical version, with typical evidence for each tier from Tier 1 to Tier 4. Treat the evidence lists as a common starting point: each program sets its own evidence depth in its policy.
Why do scoping and tiering come first?
You cannot decide what evidence to ask for until you know what the vendor does for you. Scoping captures the business case, the service, the data the vendor will hold or see, the access it will have to your systems and networks, and how much the business depends on it.
Those answers set the tier. In a four-tier model, Tier 1 Critical is about dependency (the vendor supports a critical activity and is hard to replace), Tier 2 High is about sensitivity (regulated data or privileged access), and Tiers 3 and 4 cover limited and negligible impact. If you are setting this up, start with what vendor tiering is and how to assign tiers.
US banking regulators make the same point: their Interagency Guidance on Third-Party Relationships states that not all third-party relationships present the same level of risk or criticality, and that practices should be scaled accordingly.
Scoping checklist:
- Business owner and business case recorded
- Service description and the products in use
- Data types the vendor will store, process or access
- System, network and physical access
- Dependency: what happens if the vendor is unavailable
- Regulatory relevance, such as a critical activity or regulated data
- Criticality questionnaire answered and reviewed, tier set and recorded
What evidence should you request for each tier?
The table below shows typical evidence by tier. It is illustrative: adjust it for the service type and your own policy. A consulting firm with no data access will not have a SOC 2 report and should not be marked down for it.
| Evidence | Tier 1 Critical | Tier 2 High | Tier 3 Medium | Tier 4 Low |
|---|---|---|---|---|
| SOC 2 Type 2 (or equivalent) | Required | Required, or an equivalent certification | Accepted if available | Not required |
| SOC 1 Type 2 | If relevant to financial reporting | If relevant to financial reporting | Not required | Not required |
| Penetration test summary | Required, recent | Requested | Not required | Not required |
| BCP and DR plans with test results | Required, with test results | Plan, test results if available | Not required | Not required |
| Insurance certificates | Required | Required | If contractually needed | If contractually needed |
| Financial condition | Financial statements | Summary or credit check | Not required | Not required |
| Key security and privacy policies | Required | Required | Key policies | Not required |
| Security questionnaire | Full, scoped to the service | Full, scoped to the service | Focused | Short attestation |
| Fourth parties and subservice organizations | Identified and analyzed | Identified | Not required | Not required |
| Sanctions and public-source checks | Required | Required | Required | Required |
Two practical notes. First, check certifications by scope: an ISO/IEC 27001 certificate only helps if its scope covers the service and locations you rely on. Second, sanctions and public-source checks are cheap enough to run on every vendor, whatever its tier.
Questionnaire or evidence: which matters more?
Both, for different jobs. A questionnaire tells you how the vendor says it operates and finds the areas worth testing. Evidence shows whether that is true.
- Scope the questionnaire to the tier, data and service, so vendors are not asked about controls that do not apply.
- Do not ask again what a current SOC report already covers. Ask about gaps and anything outside its scope.
- For each high-value answer, request the document that proves it: a policy, a test report, a certificate.
- Treat a missing artifact as "not evidenced", not as a pass.
How should you review the evidence?
Receiving a document is not reviewing it. For each piece of evidence, check three things and record what you found.
- Scope. Does it cover the service, systems, locations and entities you actually use?
- Dates. Is it current? Note report periods, test dates and expiry dates. For a SOC report whose period ended months ago, ask for a bridge letter.
- Exceptions. Read the results, not just the cover page: SOC report exceptions, open penetration test findings, failed recovery tests.
For SOC reports, also review subservice organizations and the complementary user entity controls (CUECs) the report assumes you operate, and map each CUEC to your own control.
How do findings, remediation and sign-off work?
Every gap that matters becomes a finding with a severity, the evidence behind it, an owner at the vendor and a target date. Follow it until it closes, and ask for evidence of closure rather than an email saying it is done. Where you decide to live with a gap, record a formal risk acceptance with a rationale, an approver with the right authority and an expiry date.
The assessment then ends with a residual risk rating and sign-off by the accountable people, with stronger sign-off for higher tiers. Keep the evidence, the review notes, the findings, approvals and the audit trail together on the vendor record, so you can answer the three questions examiners ask: who did the work, who checked it, and who approved it.
| Step | Done when |
|---|---|
| Evidence reviewed | Scope, dates and exceptions recorded for each item |
| Findings raised | Each has a severity, owner and target date |
| Risk decisions | Remediation agreed or risk formally accepted with expiry |
| Residual risk | Rated and explained |
| Sign-off | Approved by the accountable owner for the tier |
| Next review | Reassessment date set by the tier's cadence |
Frequently asked questions
What should a vendor risk assessment checklist include?
It should cover scoping and tiering, the evidence required for the vendor's tier, a review of that evidence for scope, dates and exceptions, findings with owners and target dates, risk acceptance where needed, a residual risk rating and sign-off. It should also record when the vendor will next be reassessed, based on its tier.
What evidence should we ask a critical vendor for?
A critical vendor typically provides a SOC 2 Type 2 or equivalent, a SOC 1 where it affects financial reporting, a recent penetration test summary, business continuity and disaster recovery plans with test results, financial statements, insurance certificates, key policies and information about its own critical providers. Your policy should set the exact list.
Do low-risk vendors need a full assessment?
Usually not. Lower-risk vendors with no sensitive data and no system access can receive a streamlined review, for example a short attestation with sanctions and public-source checks. Spending less effort here frees time for critical and high-risk vendors. Keep the tiering record, so you can show why the lighter review was appropriate.
Is a completed questionnaire enough evidence?
No. A questionnaire records what the vendor says about its controls. For anything that matters, ask for the document that proves the answer, such as a SOC report, a test result, a policy or a certificate. Where the vendor cannot provide proof, record the control as not evidenced and raise a finding.
About VendRisk360
VendRisk360 is an AI-assisted third-party risk management (TPRM) SaaS platform for regulated organizations. It keeps one governed record per vendor from intake to exit, assesses each vendor on evidence scaled to its risk tier, monitors vendors continuously from the outside (attack surface, data breaches, financial distress and adverse news), maps fourth and nth parties, and produces board-ready reporting. Teams run their program on the platform themselves, or turn on managed assessments and monitoring, delivered on the platform by VendRisk360’s certified reviewers. People make every decision.
This post is general guidance, not legal advice. Confirm your obligations with counsel and your supervisors.
