Vendor / Third-Party Risk Assessment Checklist — built to scale.

Test procedurePull the vendor inventory and cross-check it against active SSO/API integrations, invoices and data-sharing agreements for anything missing.

Practical example / evidenceVendor inventory/register, with last-reviewed date and an owner per vendor.

Test procedureSample five vendors across tiers and confirm the tier assigned matches the actual data/system access on file, not a guess.

Practical example / evidenceTiering methodology document and the scored tier for each vendor.

Test procedureCompare the assessment history of a high-tier and a low-tier vendor; confirm the high-tier vendor was reviewed more deeply and more often.

Practical example / evidenceAssessment calendar/schedule showing cadence by tier.

Test procedureCheck the onboarding date against the date the questionnaire or certificate was received — it should precede go-live, not follow it.

Practical example / evidenceCompleted questionnaire, SOC 2 report or ISO certificate, timestamped before go-live.

Test procedureWalk one high-tier vendor's integration end-to-end and confirm the documented access scope matches what the integration can technically reach.

Practical example / evidenceData flow diagram or access-scope document per vendor.

Test procedureRequest the vendor's current sub-processor list and confirm it was actually reviewed, not just filed.

Practical example / evidenceSub-processor list with a reviewer's sign-off or review note.

Test procedurePull the DPA for a sample of vendors handling personal data and check it against your current privacy-law obligations (e.g. DPDPA, GDPR clauses).

Practical example / evidenceSigned DPA on file for each in-scope vendor.

Test procedureSearch the contract for a named breach-notification timeframe and an audit-rights clause — a verbal understanding doesn't count.

Practical example / evidenceContract clause or addendum naming notification SLA and audit rights.

Test procedureConfirm the termination-for-cause clause explicitly covers security findings, not only payment or performance failures.

Practical example / evidenceContract clause granting termination or remediation rights on security grounds.

Test procedureCheck the last re-assessment date for a sample of vendors against the defined cadence for their tier.

Practical example / evidenceRe-assessment schedule and completed re-assessment records.

Test procedureAsk for the vendor incident log and confirm at least one entry shows an exposure assessment for your own environment, not just the vendor's.

Practical example / evidenceVendor incident log with an exposure-impact note per entry.

Test procedureCompare certificate/report expiry dates against today's date for every high-tier vendor.

Practical example / evidenceTracking sheet of certification expiry dates per vendor.

Test procedureFor a terminated vendor, confirm access logs show no activity after the offboarding date and request written deletion confirmation.

Practical example / evidenceAccess-revocation log and vendor's written data-deletion or data-return confirmation.

Test procedureCheck the offboarding record for a signed confirmation from the vendor, not just an internal checklist tick.

Practical example / evidenceSigned offboarding confirmation or closure email from the vendor.