Vendor Risk Assessment Matrix Template: How to Build and Use One
UpGuard found that 28% of the top 100 vendors most commonly used by universities have experienced a data breach since 2024.
Being widely adopted isn't the same thing as being safe, so every vendor still needs review. That gets harder as your vendor count grows and review headcount stays flat, and a High, Medium, or Low label on its own doesn't tell reviewers what to do next.
A vendor risk assessment matrix directs your review time by scoring each vendor risk on likelihood and impact, then linking the score to an action. The matrix only works when a vendor's cell changes what you do next, such as review depth or required contract terms.
In this guide, you'll get a 5x5 matrix template with a scoring key and suggested actions for each band. You'll also get a worked example that moves from inherent to residual risk, as well as a version built for procurement and legal teams.
Vendor risk assessment matrix template
A vendor risk assessment matrix scores each vendor risk by likelihood (1 to 5) and impact (1 to 5). Multiplying the two gives a score from 1 to 25, which maps to a risk band that sets a required action.
The approach follows NIST SP 800-30 Rev. 1, which treats likelihood and impact as the core factors in determining risk. IEC 31010, the risk assessment techniques companion to ISO 31000, describes the same consequence and likelihood matrix. The grid below shows every score and band in a 5x5 vendor risk matrix, with likelihood represented in the rows and impact in the columns.
The table below lists suggested defaults for what each band requires, so adjust the timelines to match your own risk appetite:
How to score likelihood and impact
Likelihood reflects how probable a vendor risk is to materialize. Base it on evidence such as the vendor's external security posture and incident history, as well as any open findings or unanswered questionnaire items.
Impact reflects the consequence to you if the risk occurs. It depends on the data the vendor holds and the systems it can reach, while operational dependency and regulatory exposure raise it further.
The scoring key below gives each level a definition tied to vendor evidence:
Written definitions help two reviewers land on the same cell. Some teams use 1 to 10 scales, but a 5-point scale keeps debates short and matches the qualitative scales in NIST SP 800-30 Rev. 1.
Inherent vs residual risk with a worked example
Inherent risk is the score before you implement any controls, and residual risk is the score after controls you've verified. A questionnaire "yes" without evidence hasn't earned a lower score.
Controls usually lower likelihood, while impact stays tied to what the vendor holds or runs. The register rows below show three vendors moving from inherent to residual scores:
A matrix template for procurement and legal teams
Procurement and legal teams can use the same 5x5 grid as a supplier risk matrix at intake and contracting. The difference sits on the impact axis, which weights contract value and switching cost alongside data and regulatory obligations.
The Interagency Guidance on Third-Party Relationships ties oversight depth to criticality across the relationship lifecycle, including contract negotiation. The Office of the Comptroller of the Currency, the Federal Reserve, and the Federal Deposit Insurance Corporation wrote it for banks. The guidance's tiering logic still carries over to most industries.
The table below maps each band to the contract clauses and approvers a supplier would typically face:
Follow these steps to create a supplier risk matrix your procurement and legal teams can run on their own:
- Define impact criteria together: Agree with procurement and legal on how contract value and switching cost map to impact levels.
- Reuse the security likelihood scale: Keep the evidence-based likelihood definitions so supplier and vendor scores match across teams.
- Score suppliers at intake: Plot each supplier before contract drafting starts, so the band shapes the negotiation.
- Map bands to clauses and approvers: Attach each clause set to its band in your contract playbook.
- Re-score at renewal: Update the supplier risk matrix whenever the supplier's data access or contract value changes.
How to build a vendor risk matrix in a spreadsheet
A spreadsheet version of the vendor risk assessment matrix works well for smaller portfolios and pilots, because it rates each risk automatically. It also lets you test your band definitions before you scale the program.
These steps use Google Sheets. The formula works in Excel, though the data validation menu differs.
The register uses the column layout below, with headers in row 6 and data starting in row 7.
These steps turn the register into a working matrix:
- Set up the risk register columns: Add the headers above in row 6, then freeze that row so labels stay visible as the register grows.
- Build the 5x5 lookup grid: Enter likelihood labels in Q7:Q11 and impact labels in R6:V6. Fill R7:V11 with each cell's band from the matrix above.
- Add dropdowns: In Google Sheets, select Data, then Data validation, then Dropdown (from a range). Point the likelihood and impact columns at the grid labels.
- Calculate the rating: Enter the formula below in H7 and copy it down. Repeat it in M7, swapping in K7 and L7.
- Color-code the bands: Use conditional formatting to give each band its own color, with green for Low and red for Critical.
- Set your risk appetite line: Decide which band requires escalation and which blocks onboarding, then mark that line on the grid.
The formula for step four looks up the row that matches the likelihood in F7 and the column that matches the impact in G7:
=IFERROR(INDEX($R$7:$V$11, MATCH(F7,$Q$7:$Q$11,0), MATCH(G7,$R$6:$V$6,0)),"")
The formula assumes likelihood labels in Q7:Q11, impact labels in R6:V6, and band ratings in R7:V11. INDEX returns the band where the matched row and column meet. IFERROR leaves the cell blank until both dropdowns have a value, which keeps half-scored rows from showing errors.
How to use the matrix across the vendor lifecycle
A matrix that only runs at onboarding goes stale as vendors change. Each stage of the third-party risk management (TPRM) lifecycle uses a vendor risk assessment matrix differently:
- Discovery: Give each new vendor a quick inherent score, so you know how much review it needs.
- Onboarding: Use the band to route approvals and set contract terms before the vendor gets access.
- Assessment: Run full inherent-to-residual scoring, with evidence requests that match the vendor's band.
- Ongoing risk management: Track remediation against the band's timeline and re-score once you verify each fix.
- Continuous monitoring: Re-plot the vendor when its external posture or service scope changes.
- Offboarding: Confirm data deletion and access removal, then retire the vendor's risks from the register.
Continuous monitoring keeps likelihood current, because security ratings update daily as a vendor's observable posture changes. Each change can move a vendor into a new cell before its next scheduled review.
Counting vendors per cell turns the matrix into a portfolio view for board reporting. Leadership sees how many vendors sit in High and Critical, and whether that count falls over time.
UpGuard Vendor Risk plots your vendor portfolio on one risk matrix, so you see how many suppliers sit in high and critical before you open a single record. The same data feeds over 14 built-in reports, and a board-ready summary can be generated in three clicks.
The vendor risk matrix data feeds directly into reporting, so you can instantly generate reports that clearly outline program performance for stakeholders and board members.
Common vendor risk matrix mistakes
Many matrix problems trace back to the data behind the scores. KPMG found that only 17% of 851 respondents in its 2026 global TPRM survey say they have completely reliable, valid, consistent, and integrated TPRM data. KPMG also names data-quality weaknesses as a barrier to automating risk scoring and continuous monitoring.
These mistakes most often weaken a vendor risk assessment matrix:
- Scoring everything Medium: Undefined scales pull scores toward the middle, so write level definitions before anyone scores a vendor.
- Blending inherent and residual scores: A single score hides what your controls are doing, so keep both in the register.
- Trusting self-reported answers for likelihood: Questionnaires describe what a vendor says it does, so confirm likelihood with external evidence and audit reports.
- Scoring without changing the workflow: Each band should change review depth, contract terms, or cadence, or the score has no effect.
- Freezing the matrix at onboarding: Re-plot vendors after trigger events, such as a breach or new data access.
How UpGuard helps you manage vendor risk
UpGuard Vendor Risk supplies the evidence and workflow behind each step of your vendor risk assessment matrix:
- Discovery and monitoring: Discover and onboard your vendors, then monitor them daily with security ratings that keep likelihood scores current.
- Risk assessments: Run security assessments and automate questionnaires, so the evidence behind each residual score sits in one place.
- Remediation: Send remediation requests for the findings that push a vendor into High or Critical, and track each fix to closure.
- Reporting: Plot your vendors on a portfolio risk matrix that feeds board-ready reporting.
Start a free trial to see how Vendor Risk scores and tracks your vendor portfolio.
Frequently asked questions
What is a vendor risk matrix?
A vendor risk matrix is a grid that ranks each vendor risk by probability and consequence, so your team reviews the riskiest vendors first.
What's the difference between inherent and residual vendor risk?
Inherent risk assumes no safeguards are in place, while residual risk is what remains after safeguards you've confirmed. The gap between the two shows how much work your controls are doing.
Should you use a 3x3, 4x4, or 5x5 risk matrix?
A 5x5 grid gives enough spread to separate High vendors from Critical ones without slowing reviewers down. Smaller grids suit small portfolios or programs with little evidence to score against.
How often should you update a vendor risk matrix?
Follow the reassessment cadence tied to each vendor's risk band. Re-score any vendor as soon as its security posture or the service it provides shifts.
Related posts
The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management
.jpeg){kind=avatar}