# Vendor Risk Assessment Template, Free to Fill In Source: https://nerix.ai/templates/vendor-risk-assessment Rate the risks of using a supplier, from data to continuity, and decide whether to approve, with conditions. Before you send it Which checks you need depends on what the vendor does. A vendor with access to personal data or critical systems needs closer review than one who supplies office paper. Laws on data and outsourcing differ by country. ## Fill it in and preview You are signed in. Fill it in your workspace and it is kept as a document you can send, share and have signed. [Open in your workspace](https://app.nerix.ai/documents/templates/vendor-risk-assessment) ### Vendor risk assessment **Company:** Northgate Supplies Ltd **Vendor:** CloudLedger Ltd **Service:** Hosted accounting software with customer invoices **Business owner:** Finance Director **Assessed by:** Risk Manager on 9 March 2027 **Yearly spend:** EUR 24,000 ## Data and systems involved Customer names and invoice details (personal data). Connects to our bank feed. ## Risk ratings | Area | Rating | | Data protection and confidentiality | Data protection and confidentiality risk | | Information security | Information security risk | | Service continuity | Service continuity risk | | Financial stability | Financial stability risk | | Legal and compliance | Legal and compliance risk | | Dependence on this vendor | Dependence on this vendor | ## Evidence reviewed Security certificate (valid to Nov 2027), data processing agreement signed, uptime history of 99.95%, 2 customer references ## Controls to ask for Encryption of data at rest and in transit Two-step sign-in for all our users Notice of any breach within 24 hours Exit plan and data export on request ## Fallback Export data monthly to our own storage; a second provider is on the shortlist. ## Decision **Decision** Sign the data processing agreement before go-live. Review again in 12 months. The assessment is repeated each year, and sooner if the service, the data involved or the vendor's situation changes. Templates are a careful starting point, not legal advice. Where the law matters, check what applies where you are. Operations and quality ## What this template is for A vendor risk assessment: what the vendor does for you, the data and systems involved, risks rated low to high, controls to ask for and an approval decision. It is free to fill in online, needs no account, and downloads as a Word document or a PDF. [See all Operations and quality templates](https://nerix.ai/templates/operations-quality) Operations and quality ## What you fill in The form asks for 19 details. The document fills itself in as you type. - ### Company name For example: Northgate Supplies Ltd - ### Vendor name For example: CloudLedger Ltd - ### What the vendor provides For example: Hosted accounting software with customer invoices - ### Business owner For example: Finance Director - ### Assessed by For example: Risk Manager - ### Date For example: 9 March 2027 - ### Yearly spend optional For example: EUR 24,000 - ### Data and systems involved What the vendor can see, hold or reach. For example: Customer names and invoice details (personal data). Connects to our bank feed. - ### Data protection and confidentiality risk - ### Information security risk - ### Service continuity risk - ### Financial stability risk - ### Legal and compliance risk - ### Dependence on this vendor - ### Evidence reviewed optional Certificates, reports, contracts, references. For example: Security certificate (valid to Nov 2027), data processing agreement signed, uptime history of 99.95%, 2 customer references - ### Controls to ask for One per line. For example: Encryption of data at rest and in transit Two-step sign-in for all our users Notice of any breach within 24 hours Exit plan and data export on request - ### Fallback if the vendor fails optional For example: Export data monthly to our own storage; a second provider is on the shortlist. - ### Decision - ### Conditions and follow-up optional For example: Sign the data processing agreement before go-live. Review again in 12 months. Operations and quality ## What is inside The parts of this document, in order. - 1 Data and systems involved - 2 Risk ratings - 3 Evidence reviewed - 4 Controls to ask for - 5 Fallback - 6 Decision Templates ## How it works - 01 ### Fill in Type your details in the form. The document fills itself in as you type; click any gap to jump to its field. - 02 ### Check Read it through. Gaps you have not filled stay marked, so nothing goes out half done. - 03 ### Download Save it as a Word document to edit further, or as a PDF to send or print. ### Make it yours with AI Open it in the chat and ask for changes: shorter, firmer, another situation, another language. [Adapt it with nerix](https://nerix.ai/try?template=vendor-risk-assessment) ### Was this template helpful? Operations and quality ## Questions people ask ### What details does this template ask for? The form asks for 19 details, starting with Company name, Vendor name, What the vendor provides, Business owner, Assessed by. 4 more are optional. ### Can I download this template as Word or PDF? Yes. When you have filled in the form, save it as a Word document to keep editing, or as a PDF to send or print. It is free and needs no account. ### Is what I type sent anywhere? No. What you type stays in your browser while you fill in the document. It only goes to nerix if you choose to open the template in the chat. ### What should I check before I use this template? Which checks you need depends on what the vendor does. A vendor with access to personal data or critical systems needs closer review than one who supplies office paper. Laws on data and outsourcing differ by country. ### Are these operations templates free? Most are. Fill in and download them for free as Word or PDF, with no account. A few longer documents are premium: free to fill in, paid once to download, and marked with their price. ### Do they meet a standard such as ISO 9001? They are a practical starting point and certify nothing. Standards and safety laws differ by industry and country, so check what applies to you. ### Who should approve a procedure? The person who owns the process and a manager who can authorise it. The procedure template has fields for both, and for the review date. Templates ## More in Operations and quality - [Allergen and food safety record One page for the kitchen: allergens by dish, daily temperature and cleaning checks, and what was done about problems. Operations and quality](https://nerix.ai/templates/allergen-and-food-safety-record) - [Asset handover and return form Record equipment given to a person and returned later, with condition and signatures. Operations and quality](https://nerix.ai/templates/asset-handover-and-return-form) - [Asset register List what the business owns: each asset, who has it, where it is, what it is worth and its condition. Operations and quality](https://nerix.ai/templates/asset-register) - [Business continuity plan Plan how to keep critical work going through a fire, outage, supplier failure or loss of people. Operations and quality Premium, €4.99](https://nerix.ai/templates/business-continuity-plan) - [Capacity plan Work out whether you can meet future demand: current use, expected growth, gaps, options and what to decide. Operations and quality](https://nerix.ai/templates/capacity-plan) - [Class register Record attendance for one class or session, with late and absent names and the reason. Operations and quality](https://nerix.ai/templates/class-register) [See all Operations and quality templates](https://nerix.ai/templates/operations-quality) Templates ## More kinds of documents Every category has its own page, so you can see all of its templates at once. ## Use it in nerix ### Use it in nerix - [Templates](https://nerix.ai/product/templates) - [Quality records](https://nerix.ai/product/quality-records) - [Checks](https://nerix.ai/product/audits) ### Learn more - [How to Make a Document From a Template](https://nerix.ai/help/make-a-document-from-a-template) - [Operations and quality](https://nerix.ai/templates/operations-quality)