Templates › Inspections › SEO page

Run: Vendor Due Diligence and Third-Party Risk Review

Use this vendor due diligence and third-party risk review template to document a critical supplier’s security, financial, continuity, and contract controls i...

Fill this out, get a PDF emailed to you. No account required. Want to run it with your team and track results? Sign up free →

Inspection Details and Scope

Vendor name and service scope documented

Record the legal entity name, service description, and business unit using the service.

Review type and date recorded critical (required)

Capture whether this is onboarding, annual review, renewal, or event-driven reassessment.

Vendor risk tier confirmed critical (required)

Confirm the assigned risk tier for this vendor.

Evidence package complete critical (required)

Confirm the due diligence file includes current questionnaires, certifications, SOC reports, financial statements, and contract documents as applicable.

Yes No N/A

Security and Access Controls

Access control policy covers least privilege and role-based access critical (required)

Verify the vendor maintains documented access control standards aligned to least privilege and role-based access.

Yes No N/A

Multi-factor authentication enforced for administrative and remote access critical (required)

Confirm MFA is required for privileged accounts and remote administrative access.

Yes No N/A

Encryption used for data in transit and at rest critical (required)

Verify encryption controls are in place for sensitive or regulated data handled by the vendor.

Yes No N/A

Vulnerability and patch management cadence documented

Document the vendor's vulnerability scanning frequency, patch timelines, and remediation escalation process.

Security incident notification timeframe meets contract requirements critical (required)

Record the required notification window for security incidents.

Independent security assessment current critical (required)

Confirm the most recent independent security assessment or attestation is current.

Financial Condition and Business Continuity

Latest financial statements reviewed critical (required)

Confirm the most recent audited or reviewed financial statements were obtained and analyzed.

Liquidity or going-concern concerns identified critical (required)

Indicate whether any material liquidity, solvency, or going-concern concerns were identified during review.

Yes No N/A

Business continuity and disaster recovery plan current critical (required)

Verify the vendor has a documented and tested BCP/DR plan appropriate to the service criticality.

Yes No N/A

BCP/DR test date recorded

Record the date of the most recent business continuity or disaster recovery exercise.

Note (optional)

Contract Provisions and Legal Safeguards

Contract includes confidentiality and data protection obligations critical (required)

Verify the agreement includes confidentiality, data handling, and privacy obligations appropriate to the data processed.

Yes No N/A

Right to audit or assess included critical (required)

Confirm the contract grants the organization the right to audit, assess, or obtain independent assurance reports.

Yes No N/A

Subcontractor flow-down requirements included critical (required)

Verify the vendor must flow down applicable security, confidentiality, and compliance obligations to subcontractors.

Yes No N/A

Termination and exit assistance provisions documented

Summarize termination rights, data return/deletion obligations, and transition assistance terms.

Insurance coverage meets minimum requirements critical (required)

Confirm the vendor's insurance coverage is current and meets contractual minimums.

Compliance, Monitoring, and Findings

Regulatory and contractual obligations mapped

Identify the obligations applicable to this vendor relationship.

Open findings from prior reviews tracked to closure critical (required)

Confirm prior deficiencies or non-conformances have documented owners, due dates, and closure evidence.

Yes No N/A

Overall vendor risk review outcome critical (required)

Document the final disposition of the review.

Inspector signature critical (required)

Signature of the reviewer completing the due diligence assessment.

Get your results

Enter your email — we'll send you a PDF of your filled-out template, plus the occasional MangoScoop newsletter (templates, workflow tips, product updates). Unsubscribe anytime — link is in every email.

Email (required)

Your name (optional)

Generated with MangoApps Templates — browse 250+ free