Third-Party Risk Assessment Template
A proportional assessment worksheet for external service scope, dependencies, evidence, controls, residual risk, and monitoring.
Key Takeaways
- ✓Define the service boundary and dependencies.
- ✓Evaluate evidence for scope, currency, and limitations.
- ✓Track residual decisions, actions, and change-triggered reassessment.
Third-Party Risk Assessment Template
Purpose and boundary
Use this worksheet to document a risk assessment for a defined external service relationship. It supports proportionate decisions based on service criticality, data and access, dependencies, and available evidence. It is not a certification of the provider, a substitute for procurement/legal review, or a sector-specific compliance assessment.
Assessment steps
1. Define service, business purpose, boundaries, data flows, access, and material subcontractors.
2. Determine inherent exposure using approved criteria and documented assumptions.
3. Request evidence proportionate to the service; record source, date, scope, and limitations.
4. Evaluate controls, concentration and continuity dependencies, incident communication, and change practices.
5. Record residual exposure, treatment, contractual or operational actions for authorized review, and reassessment triggers.
Blank assessment
| Provider / service | Criticality / objective | Data / access | Dependencies / subcontractors | Risk scenario |
|---|
Frequently asked questions
Does a provider certificate eliminate assessment work?
No. Verify scope, period, service coverage, and limitations against the organization’s needs.
Should every provider receive the same assessment?
Use approved proportional criteria based on service criticality, access, data, dependencies, and evidence.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.