Vendor Risk Assessment
Score a supplier on security, data handling, continuity and business risk using the questions you'd put to them, and see which gaps to close before you rely on them.
- Free
- No sign-up to try
- Works as you type
Answer for one vendor from what they've shown you and what your contract says. Higher scores mean lower risk.
0 of 12 answered
Answer the questions to see your score by area as you go.
Answer at least 10 of 12 questions to save your results as a Room.
How it works
How the Vendor Risk Assessment works
- 1
Answer the questions
Pick the answer closest to where you are today. It takes a few minutes.
- 2
See your score
Your score by area appears as you answer, with the weakest areas first.
- 3
Save your results
Create a Room with your scores, next steps and an adviser to talk them through.
Worked example
What it makes
12 questions across 4 areas. Each answer scores 0 to 3; an area's score is its points as a share of the most it could get.
Security
- What security evidence has the vendor provided?
- Does the vendor use multi-factor sign-in and limit staff access to your data?
- How would the vendor tell you about a security incident?
Data handling
- Do you know what data the vendor will hold and where?
- What happens to your data when the contract ends?
- Does the contract cover data protection obligations?
Continuity
- How critical is this vendor, and do you have an alternative?
- Does the vendor have backup and recovery arrangements?
- Are service levels defined?
Business and oversight
- How financially stable does the vendor appear?
- Does the vendor rely on subcontractors for key parts of the service?
- How often will you review this vendor?
Results bands: High risk (0+), Elevated risk (40+), Moderate risk (70+), Low risk (90+). A self-assessment from your own answers: a starting point for a conversation, not an audit, certification or professional advice.
Who it's for
Who uses it
Procurement teams
Check a new supplier before signing.
Security and IT
Review vendors that will hold customer or company data.
Operations managers
Review critical suppliers at renewal.
Good to know
What to consider
- You answer from the vendor's evidence and your contract; it doesn't contact or verify the vendor.
- A higher score means lower risk. It isn't legal advice: have contracts reviewed where the stakes are high.
Questions
About the Vendor Risk Assessment
Can I send the questions to the vendor?
Yes. The questions work as a short questionnaire. Score their answers yourself, and ask for evidence where an answer matters.
Is this an audit or a certification?
No. It scores your own answers against a written rubric to show where you stand and what to do next. Use it to start a conversation, not as an audit, certification or professional advice.
Make your results now
Free, no sign-up to try. It becomes a Room you can edit, publish and share.
Create my resultsRelated
Related tools
- Vendor Evaluation ScorecardScore vendors against weighted criteria and get a ranked scorecard with the method shown, ready to share with stakeholders.
- Vendor Onboarding ChecklistMake a vendor onboarding checklist for a new supplier: documents, checks, finance setup, kickoff and a first review, with an owner for each stage.
- Supplier Evaluation ScorecardScore suppliers on quality, delivery, total cost and risk with weights you agree up front, and share a ranked scorecard with the method shown.