◆ Quick answer
A vendor due diligence questionnaire should cover information security, independent assurance (SOC reports), incident response, business continuity, subcontractors, privacy and data handling, regulatory compliance, financial condition and insurance, and service delivery, with the evidence to request for each question and a separate set of questions for vendors that use AI.
Guide vs. template
This guide explains what belongs in the template. The paid template gives you the editable working files so you're not rebuilding from a blank page.
Paid template includes
- ◆ 12-tab Excel workbook: Start Here, Dashboard, Vendor Inventory, Methodology, Due Diligence, AI Vendor Assessment, Contract Provisions, Monitoring Tracker, Concentration Risk, Offboarding, Regulatory Reference and Lookups
- ◆ Vendor Inventory for up to 500 vendors: five 1-to-4 tiering factors, a Critical floor (including six Critical categories), four tiers (Critical, High, Medium, Low), overrides only with a written rationale, and reassessment due dates every 12, 12, 24 or 36 months by tier
- ◆ Due Diligence: 48 questions in 9 domains with 6 knock-out questions, one column per vendor for up to 25 vendors, scored to Satisfactory, Needs Improvement or High Risk
- ◆ AI Vendor Assessment: 21 questions (4 knock-outs) for up to 10 vendors that use artificial intelligence, covering model risk, fair lending and adverse action reasons, data use and AI training, security and fourth-party model providers
What is this template for?
A vendor due diligence questionnaire is how you decide whether a third party can do the work safely, in compliance with the law, for as long as you need it. The useful version is tiered: you score the vendor first, and the tier decides how deep the review goes, how often it repeats and which contract terms you need. Each question asks for evidence, a few controls count as knock-outs that fail the review on their own, and the result feeds a residual rating someone has to accept. The 2023 Interagency Guidance on Third-Party Relationships, the guidance in effect for banks, expects due diligence scaled to the risk of each relationship.
◆ Audience
Who needs this.
- ◆ You are onboarding a vendor that touches customer data, money movement, compliance work or production systems.
- ◆ Your bank partner asked how you assess critical vendors and wants to see the evidence.
- ◆ Every vendor gets the same questionnaire, so the review is either too heavy for small vendors or too light for critical ones.
- ◆ A vendor uses AI in its service and your questionnaire does not ask about models, training data or adverse action reasons.
◆ Required fields
What every row needs.
The fields that make this template defensible to an auditor, bank partner, or examiner — and what goes in each.
| Field | Why it matters | Example |
|---|---|---|
| Services provided and business owner | Defines what you rely on and who answers for the relationship. | Ledgerline Core Systems: account ledger and transaction processing platform; owner: the COO |
| Tier and the scores behind it | Sets the depth of review, the reassessment date and the contract terms required. | Critical: business criticality 4 and a core or ledger category, which are Critical floors whatever the average |
| Questions with evidence to request | An answer without evidence is an assertion. | MFA for all remote and privileged access; evidence: MFA policy and the SOC report control |
| Knock-out questions | A few controls matter more than the score; one failure should fail the review. | MFA, encryption, a current independent attestation, incident response, business continuity, subcontractor oversight |
| SOC report details | Shows whether the assurance is current and covers your services. | SOC 1 Type 2, period ended 06/30/2025, no bridge letter: stale after 12 months |
| AI use | Vendors that use AI need questions a standard questionnaire does not ask. | Machine-learning underwriting model for small-dollar loans: validation, fair lending testing, adverse action reasons, no training on your data |
| Result and residual rating | Turns the answers into a decision someone owns. | Needs Improvement; residual Critical; risk acceptance required with owner and expiry |
◆ Worked example
Example: one sample vendor through the review
| Vendor | Harborlight Support Services, a fictional customer support outsourcer: scores 3, 3, 3, 2, 2 on the five tiering factors, an average of 2.60, so High tier with a 12-month reassessment cycle. |
|---|---|
| Due diligence | 48 of 48 questions answered and a 92% score, but the subcontractor oversight knock-out (SC-01) is Unsatisfactory: an offshore after-hours support subcontractor was not disclosed. One failed knock-out makes the result High Risk. |
| Residual rating | High tier, plus one notch for the High Risk result and one for the open High issue, gives Critical. A risk acceptance with a named owner and an expiry date is required, and the issue goes on the Monitoring Tracker with a due date. |
◆ Implementation roadmap
How to roll this out.
Score the vendor on five factors and set the tier
Owner · Business owner, reviewed by third-party risk
Output · Critical, High, Medium or Low tier with the scores and any override rationale on file
Scale the review to the tier
Owner · Third-party risk lead
Output · Full questionnaire, SOC report and financial review for Critical and High vendors; lighter checks for Medium; inventory and renewal check for Low
Collect evidence and read the SOC report
Owner · Security, compliance and the business owner
Output · Answers backed by documents, with report scope, period, bridge letter, user entity controls and exceptions reviewed
Score the answers and apply the knock-outs
Owner · Third-party risk reviewer
Output · Satisfactory, Needs Improvement or High Risk, with findings logged as issues
Rate residual risk and record acceptance
Owner · Business line executive + risk
Output · Residual rating, and for Critical or High a risk acceptance with owner, date and expiry
Set the next reassessment and monitoring
Owner · Third-party risk owner
Output · Next due date from the tier, SOC report and bridge letter tracking, issue follow-up
◆ Ready to use it?
Download the Third-Party Risk Management (TPRM) Kit.
Use the guide to understand the structure, or buy the editable template to move faster.
◆ FAQ
Frequently asked questions.
What should a vendor due diligence questionnaire include? ⌄
Questions on information security, independent assurance such as SOC reports, incident response, business continuity, subcontractors, privacy and data handling, regulatory compliance, financial condition and insurance, and service delivery, each with the evidence to request. Vendors that use AI need an additional set of questions on models, data use and fair lending where they make credit decisions.
Should every vendor complete the same questionnaire? ⌄
No. Tier vendors first and scale the review to the tier. A Critical vendor gets the full questionnaire, a close read of its SOC report and a financial review; a Low vendor may need nothing more than an inventory entry and a check at renewal. The 2023 Interagency Guidance expects oversight to be commensurate with the risk of each relationship.
What is a knock-out question? ⌄
A question whose failure fails the review regardless of the overall score, for example no multi-factor authentication on privileged access or no oversight of subcontractors. Without knock-outs, a vendor can score 92% while missing a control that makes the rest irrelevant.
Which third-party guidance is in effect for banks? ⌄
The 2023 Interagency Guidance on Third-Party Relationships: Risk Management, released by the OCC (Bulletin 2023-17), the FDIC (FIL-29-2023) and the Federal Reserve (SR 23-4). It replaced the agencies' earlier third-party guidance. In September 2026 the agencies and the NCUA proposed guidance to replace it (91 FR 58536, comments due November 16, 2026); the proposal is not in effect until finalized.
What is the difference between third-party risk and vendor management? ⌄
Vendor management handles contracts, performance and the relationship. Third-party risk management focuses on the risks created by relying on the vendor and the controls, contract terms and monitoring needed to manage them.