[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Vendor Risk Management](/category/vendor-risk-management) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Vendor Risk Assessment Matrix Template: How to Build and Use One](/blog/vendor-risk-management-assessment-matrix) Publish date October 13, 2026 {x} minute read # Vendor Risk Assessment Matrix Template: How to Build and Use One [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Cassy van Eeden](/team/cassy-van-eeden) Content Writer Cassy is a Content Writer at UpGuard with a background in B2B SaaS and tech writing. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) ‍[UpGuard](https://www.upguard.com/press/new-upguard-report-nearly-1-in-3-top-higher-education-vendors-had-a-security-breach-since-2024) found that 28% of the top 100 vendors most commonly used by universities have experienced a data breach since 2024. Being widely adopted isn't the same thing as being safe, so every vendor still needs review. That gets harder as your vendor count grows and review headcount stays flat, and a High, Medium, or Low label on its own doesn't tell reviewers what to do next. A vendor risk assessment matrix directs your review time by scoring each vendor risk on likelihood and impact, then linking the score to an action. The matrix only works when a vendor's cell changes what you do next, such as review depth or required contract terms. In this guide, you'll get a 5x5 matrix template with a scoring key and suggested actions for each band. You'll also get a worked example that moves from inherent to residual risk, as well as a version built for procurement and legal teams. ## Vendor risk assessment matrix template A vendor risk assessment matrix scores each vendor risk by likelihood (1 to 5) and impact (1 to 5). Multiplying the two gives a score from 1 to 25, which maps to a risk band that sets a required action. The approach follows [NIST SP 800-30 Rev. 1](https://csrc.nist.gov/pubs/sp/800/30/r1/final), which treats likelihood and impact as the core factors in determining risk. [IEC 31010](https://www.federalreserve.gov/frrs/guidance/interagency-guidance-on-third-party-relationships.htm), the risk assessment techniques companion to ISO 31000, describes the same consequence and likelihood matrix. The grid below shows every score and band in a 5x5 vendor risk matrix, with likelihood represented in the rows and impact in the columns. | Likelihood | Impact 1 (Minimal) | Impact 2 (Minor) | Impact 3 (Moderate) | Impact 4 (Major) | Impact 5 (Severe) | | ------------------ | ------------------ | ---------------- | ------------------- | ---------------- | ----------------- | | 5 (Almost certain) | 5 Medium | 10 High | 15 High | 20 Critical | 25 Critical | | 4 (Likely) | 4 Low | 8 Medium | 12 High | 16 High | 20 Critical | | 3 (Possible) | 3 Low | 6 Medium | 9 Medium | 12 High | 15 High | | 2 (Unlikely) | 2 Low | 4 Low | 6 Medium | 8 Medium | 10 High | | 1 (Rare) | 1 Low | 2 Low | 3 Low | 4 Low | 5 Medium | The table below lists suggested defaults for what each band requires, so adjust the timelines to match your own risk appetite: | Band | Review depth | Approver | Remediation timeline (suggested) | Reassessment cadence (suggested) | | ------------------- | ------------------------------------------------------------ | ----------------------------------------------------------- | ------------------------------------------------ | ------------------------------------- | | Low (1 to 4) | Posture check and self-attestation | Business owner of the vendor | Within 180 days | Every two years | | Medium (5 to 9) | Standard questionnaire with evidence review | Vendor risk manager | Within 90 days | Annually | | High (10 to 19) | Full assessment with documents such as a SOC 2 report | Security lead | Within 30 days | Every six months | | Critical (20 to 25) | Full assessment, evidence validation, and executive sign-off | Chief information security officer (CISO) or risk committee | Before signature, or 14 days for current vendors | Quarterly, with continuous monitoring | ### How to score likelihood and impact Likelihood reflects how probable a vendor risk is to materialize. Base it on evidence such as the vendor's external security posture and incident history, as well as any open findings or unanswered questionnaire items. Impact reflects the consequence to you if the risk occurs. It depends on the data the vendor holds and the systems it can reach, while operational dependency and regulatory exposure raise it further. The scoring key below gives each level a definition tied to vendor evidence: | Level | Likelihood (vendor evidence) | Impact (consequence to you) | | ----- | --------------------------------------------------------------------- | ------------------------------------------------------------------------- | | 5 | Almost certain: Exploitable findings or an unresolved recent breach | Severe: Regulated data at scale or core system access, with no substitute | | 4 | Likely: Several high-severity findings and unanswered control gaps | Major: Sensitive data or privileged access; outages halt critical work | | 3 | Possible: Open findings, with controls attested but partly documented | Moderate: Limited personal data, with a workable fallback | | 2 | Unlikely: Strong posture and an independent audit report on file | Minor: Non-sensitive data and narrow access, readily replaced | | 1 | Rare: Strong posture, verified controls, and no incident history | Minimal: No data or system access | Written definitions help two reviewers land on the same cell. Some teams use 1 to 10 scales, but a 5-point scale keeps debates short and matches the qualitative scales in NIST SP 800-30 Rev. 1. ### Inherent vs residual risk with a worked example Inherent risk is the score before you implement any controls, and residual risk is the score after controls you've verified. A questionnaire "yes" without evidence hasn't earned a lower score. Controls usually lower likelihood, while impact stays tied to what the vendor holds or runs. The register rows below show three vendors moving from inherent to residual scores: | Risk ID | Vendor | Risk | Inherent (likelihood × impact) | Controls and evidence | Residual (likelihood × impact) | Owner | Action | | ------- | ------------------------------------------ | --------------------------------------- | ------------------------------ | ------------------------------------------------------------------------------------ | ------------------------------ | ------------------------- | -------------------------------------------------------------------- | | V-01 | Payroll SaaS provider holding employee PII | Breach of employee PII | 4 × 5 = 20 Critical | SOC 2 Type II report reviewed; multi-factor authentication and encryption verified | 2 × 5 = 10 High | HR operations lead | Approve with a breach-notification clause; reassess every six months | | V-02 | Critical cloud host | Extended outage of production workloads | 3 × 5 = 15 High | Failover test results reviewed; backup restore claimed but not shown, so not counted | 2 × 5 = 10 High | IT infrastructure lead | Accept with risk committee sign-off and an exit plan | | V-03 | Marketing agency with limited data | Exposure of campaign contact lists | 3 × 2 = 6 Medium | Access to one shared folder, confirmed in review | 2 × 2 = 4 Low | Marketing operations lead | Approve; reassess every two years | ### A matrix template for procurement and legal teams Procurement and legal teams can use the same 5x5 grid as a supplier risk matrix at intake and contracting. The difference sits on the impact axis, which weights contract value and switching cost alongside data and regulatory obligations. The Interagency Guidance on Third-Party Relationships ties oversight depth to criticality across the relationship lifecycle, including contract negotiation. The Office of the Comptroller of the Currency, the Federal Reserve, and the Federal Deposit Insurance Corporation wrote it for banks. The guidance's tiering logic still carries over to most industries. The table below maps each band to the contract clauses and approvers a supplier would typically face: Follow these steps to create a supplier risk matrix your procurement and legal teams can run on their own: 1. **Define impact criteria together:** Agree with procurement and legal on how contract value and switching cost map to impact levels. 2. **Reuse the security likelihood scale:** Keep the evidence-based likelihood definitions so supplier and vendor scores match across teams. 3. **Score suppliers at intake:** Plot each supplier before contract drafting starts, so the band shapes the negotiation. 4. **Map bands to clauses and approvers:** Attach each clause set to its band in your contract playbook. 5. **Re-score at renewal:** Update the supplier risk matrix whenever the supplier's data access or contract value changes. ## How to build a vendor risk matrix in a spreadsheet A spreadsheet version of the vendor risk assessment matrix works well for smaller portfolios and pilots, because it rates each risk automatically. It also lets you test your band definitions before you scale the program. These steps use Google Sheets. The formula works in Excel, though the data validation menu differs. The register uses the column layout below, with headers in row 6 and data starting in row 7. | Column | Field | | ------ | ------------------- | | A | Risk ID | | B | Vendor | | C | Risk description | | D | Cause | | E | Owner | | F | Inherent likelihood | | G | Inherent impact | | H | Inherent rating | | I | Controls | | J | Control owner | | K | Residual likelihood | | L | Residual impact | | M | Residual rating | These steps turn the register into a working matrix: 1. **Set up the risk register columns:** Add the headers above in row 6, then freeze that row so labels stay visible as the register grows. 2. **Build the 5x5 lookup grid:** Enter likelihood labels in Q7:Q11 and impact labels in R6:V6. Fill R7:V11 with each cell's band from the matrix above. 3. **Add dropdowns:** In Google Sheets, select Data, then Data validation, then Dropdown (from a range). Point the likelihood and impact columns at the grid labels. 4. **Calculate the rating:** Enter the formula below in H7 and copy it down. Repeat it in M7, swapping in K7 and L7. 5. **Color-code the bands:** Use conditional formatting to give each band its own color, with green for Low and red for Critical. 6. **Set your risk appetite line:** Decide which band requires escalation and which blocks onboarding, then mark that line on the grid. The formula for step four looks up the row that matches the likelihood in F7 and the column that matches the impact in G7: ```javascript =IFERROR(INDEX($R$7:$V$11, MATCH(F7,$Q$7:$Q$11,0), MATCH(G7,$R$6:$V$6,0)),"") ``` The formula assumes likelihood labels in Q7:Q11, impact labels in R6:V6, and band ratings in R7:V11. INDEX returns the band where the matched row and column meet. IFERROR leaves the cell blank until both dropdowns have a value, which keeps half-scored rows from showing errors. ## How to use the matrix across the vendor lifecycle A matrix that only runs at onboarding goes stale as vendors change. Each stage of the [third-party risk management (TPRM) lifecycle](https://www.upguard.com/category/third-party-risk-management) uses a vendor risk assessment matrix differently: * **Discovery:** Give each new vendor a [quick inherent score](https://www.upguard.com/blog/vendor-tiering-that-scales), so you know how much review it needs. * **Onboarding:** Use the band to route approvals and set contract terms before the vendor gets access. * **Assessment:** Run [full inherent-to-residual scoring](https://www.upguard.com/blog/vendor-risk-assessment), with evidence requests that match the vendor's band. * **Ongoing risk management:** Track remediation against the band's timeline and re-score once you verify each fix. * **Continuous monitoring:** Re-plot the vendor when its external posture or service scope changes. * **Offboarding:** Confirm data deletion and access removal, then retire the vendor's risks from the register. Continuous monitoring keeps likelihood current, because [security ratings](https://www.upguard.com/product/security-ratings) update daily as a vendor's observable posture changes. Each change can move a vendor into a new cell before its next scheduled review. Counting vendors per cell turns the matrix into a [portfolio view for board reporting](https://www.upguard.com/blog/vendor-risk-management-dashboard). Leadership sees how many vendors sit in High and Critical, and whether that count falls over time. > *UpGuard Vendor Risk plots your vendor portfolio on one risk matrix, so you see how many suppliers sit in high and critical before you open a single record. The same data feeds over 14 built-in reports, and a board-ready summary can be generated in three clicks.* The vendor risk matrix data feeds directly into reporting, so you can instantly generate reports that clearly outline program performance for stakeholders and board members. ## Common vendor risk matrix mistakes Many matrix problems trace back to the data behind the scores. [KPMG](https://kpmg.com/de/en/services/audit/forensic/global-third-party-risk-management-survey-2026.html) found that only 17% of 851 respondents in its 2026 global TPRM survey say they have completely reliable, valid, consistent, and integrated TPRM data. KPMG also names data-quality weaknesses as a barrier to automating risk scoring and continuous monitoring. These mistakes most often weaken a vendor risk assessment matrix: * **Scoring everything Medium:** Undefined scales pull scores toward the middle, so write [level definitions](https://www.upguard.com/blog/vendor-risk-assessment-criteria) before anyone scores a vendor. * **Blending inherent and residual scores:** A single score hides what your controls are doing, so keep both in the register. * **Trusting self-reported answers for likelihood:** Questionnaires describe what a vendor says it does, so confirm likelihood with external evidence and audit reports. * **Scoring without changing the workflow:** Each band should change review depth, contract terms, or cadence, or the score has no effect. * **Freezing the matrix at onboarding:** Re-plot vendors after trigger events, such as a breach or new data access. ## How UpGuard helps you manage vendor risk [UpGuard Vendor Risk](https://www.upguard.com/product/vendor-risk) supplies the evidence and workflow behind each step of your vendor risk assessment matrix: * **Discovery and monitoring:** Discover and onboard your vendors, then monitor them daily with security ratings that keep likelihood scores current. * **Risk assessments:** Run security assessments and [automate questionnaires](https://www.upguard.com/blog/vendor-risk-assessment-questionnaire-template), so the evidence behind each residual score sits in one place. * **Remediation:** Send remediation requests for the findings that push a vendor into High or Critical, and track each fix to closure. * **Reporting:** Plot your vendors on a portfolio risk matrix that feeds board-ready reporting. Start a [free trial](https://www.upguard.com/demo) to see how Vendor Risk scores and tracks your vendor portfolio. ## Frequently asked questions ### What is a vendor risk matrix? A vendor risk matrix is a grid that ranks each vendor risk by probability and consequence, so your team reviews the riskiest vendors first. ### What's the difference between inherent and residual vendor risk? Inherent risk assumes no safeguards are in place, while residual risk is what remains after safeguards you've confirmed. The gap between the two shows how much work your controls are doing. ### Should you use a 3x3, 4x4, or 5x5 risk matrix? A 5x5 grid gives enough spread to separate High vendors from Critical ones without slowing reviewers down. Smaller grids suit small portfolios or programs with little evidence to score against. ### How often should you update a vendor risk matrix? Follow the reassessment cadence tied to each vendor's risk band. Re-score any vendor as soon as its security posture or the service it provides shifts. Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Third-Party Risk Management #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 26, 2026 Third-Party Risk Management #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 Third-Party Risk Management #### [The Vendor Assurance Confidence Gap: Why It’s Widest With Your Most Critical Vendors](/blog/vendor-assurance-confidence-gap) Vendor assurance efforts are rising while confidence in them is falling. This gap is widest with the vendors that matter most. Here’s why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 25, 2026 Third-Party Risk Management #### [Higher Education TPRM in 2026: New Research Maps the Vendor Visibility Gap](/blog/higher-education-tprm-2026) Explore UpGuard’s latest research into higher education third-party risk, including supplier concentration and systemic vendor exposure. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 10, 2026 Vendor Risk Management #### [Vendor Tiering That Scales: A Weighted-Model Implementation Guide](/blog/vendor-tiering-that-scales) UpGuard's guide to vendor tiering at scale: a weighted risk model that tiers vendors objectively and routes high-risk vendors for review automatically. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 13, 2026 Vendor Risk Management #### [The Vendor Tiering Series: Why Tier Your Vendors](/blog/vendor-tiering-why-tier-vendors) When every vendor is a priority, none actually are. Learn how effective vendor tiering defines criticality and maintains a defensible security posture. [](/team/revashni-moodley) [Revashni Moodley](#) February 25, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)