Purpose of the Template
Managing third-party relationships in a financial institution requires a structured approach to evaluate vendors before signing contracts and throughout the relationship lifecycle. This template helps you document risk assessments for both ICT and non-ICT service providers in a format that aligns with the European Banking Authority's guidelines and creates a defensible audit trail.
Use this template when:
- Evaluating a new vendor before contract execution
- Conducting annual reviews of existing critical vendors
- Responding to a service disruption or control failure
- Preparing for regulatory examinations
The template supports the full lifecycle approach required by the EBA: initial risk assessment, due diligence findings, monitoring protocols, and exit planning. It applies to cloud hosting providers, payroll processors, marketing agencies, facilities management firms, and any other third party that could disrupt your operations if they fail.
Getting Started
Before filling out the template, gather:
- Service description documentation from the vendor (SOWs, service catalogs, technical specifications).
- Your internal criticality assessment (which business functions depend on this vendor, what happens if they go offline).
- Vendor compliance certifications (SOC 2 reports, ISO 27001 certificates, financial statements).
- Contract terms (SLAs, termination clauses, data handling provisions).
- Subcontractor disclosures (who the vendor relies on to deliver services to you).
Identify who owns the vendor relationship internally. Risk assessment isn't a solo compliance exercise. You need input from the business unit using the service, IT security if it's a technology vendor, legal for contract terms, and procurement for financial stability.
The Template
THIRD-PARTY RISK ASSESSMENT
Assessment Date: [DATE]
Assessor Name and Role: [NAME, TITLE]
Vendor Name: [LEGAL ENTITY NAME]
Service Provided: [BRIEF DESCRIPTION]
---
SECTION 1: CRITICALITY CLASSIFICATION
Business Function Supported:
[Describe which operations depend on this vendor]
Impact of Service Disruption:
☐ Critical (Operations stop, customer impact within hours)
☐ High (Significant degradation, workarounds available)
☐ Medium (Inconvenience, alternative processes exist)
☐ Low (Minimal impact, easily replaceable)
Justification for Classification:
[Explain your rating. Be specific about what breaks if this vendor fails.]
Maximum Tolerable Downtime: [X hours/days]
---
SECTION 2: INHERENT RISK ASSESSMENT
For each risk category, rate: Low / Medium / High / Not Applicable
Operational Risk: [RATING]
Notes: [Can they deliver consistently? Do they have backup systems? What's their incident history?]
Financial Risk: [RATING]
Notes: [Are they financially stable? Could they go bankrupt? Do they have insurance?]
Compliance Risk: [RATING]
Notes: [Do they handle regulated data? Are they subject to sector-specific rules? Do they operate in high-risk jurisdictions?]
Reputational Risk: [RATING]
Notes: [If they fail or behave badly, does it reflect on you? Are they customer-facing?]
Concentration Risk: [RATING]
Notes: [How many critical services do you get from this vendor? Could you survive if you had to exit?]
ICT Security Risk (if applicable): [RATING]
Notes: [Do they access your systems? Do they store your data? What's their security posture?]
Subcontracting Risk: [RATING]
Notes: [Who do they rely on? List critical subcontractors. Do you have visibility into those relationships?]
---
SECTION 3: DUE DILIGENCE FINDINGS
Control Environment Assessment:
[Summarize their control framework. Do they have SOC 2? ISO certifications? Internal audit function?]
Financial Stability:
[Credit rating, years in business, financial statement review, insurance coverage]
Legal and Regulatory Compliance:
[Do they meet data protection requirements? Are they registered/licensed where required? Any enforcement actions?]
Business Continuity Capability:
[Do they have disaster recovery plans? Backup sites? Have they tested them? When?]
Information Security Controls (if applicable):
[Encryption standards, access controls, penetration testing, incident response capability]
Subcontractor Management:
[How do they oversee their subcontractors? Do you have the right to audit subcontractors?]
Red Flags Identified:
[List any concerns that need mitigation before or after contract signature]
---
SECTION 4: RESIDUAL RISK AND MITIGATION
After considering the vendor's controls and your contract terms:
Residual Risk Rating: [Low / Medium / High]
Required Mitigations:
1. [Specific action, owner, deadline]
2. [Specific action, owner, deadline]
3. [Specific action, owner, deadline]
Contract Provisions Required:
☐ Right to audit
☐ Subcontractor notification and approval rights
☐ Data breach notification timeline
☐ Business continuity testing requirements
☐ Termination assistance obligations
☐ [Other: specify]
---
SECTION 5: ONGOING MONITORING PLAN
Monitoring Frequency: [Monthly / Quarterly / Annually]
Monitoring Activities:
☐ SLA performance review
☐ Security incident review
☐ Financial health check
☐ Compliance certification renewal verification
☐ Subcontractor change notifications
☐ [Other: specify]
Assigned Monitor: [Name and role]
Escalation Triggers:
[What events require immediate escalation? Examples: data breach, missed SLA three months running, financial downgrade, loss of required certification]
---
SECTION 6: EXIT STRATEGY
Transition Complexity: [Low / Medium / High]
Transition Timeline: [Estimated months to exit]
Exit Planning Elements:
☐ Data extraction and return procedures documented
☐ Alternative vendors identified
☐ Knowledge transfer requirements defined
☐ Customer communication plan exists
☐ Regulatory notification requirements understood
Critical Exit Risks:
[What could go wrong during transition? Data loss? Service gaps? Customer disruption?]
---
APPROVAL
Business Owner: [Name, Signature, Date]
Risk Manager: [Name, Signature, Date]
Compliance Officer: [Name, Signature, Date]
Next Review Date: [DATE]
Customizing the Template
For ICT vendors, expand Section 2 to include detailed technical risk categories: data residency, encryption standards, API security, patch management practices, and incident response time commitments. Add a subsection under due diligence for penetration testing results and vulnerability management.
For non-ICT vendors, you can remove or simplify the ICT security section, but don't skip it entirely. Even a facilities management company might have access to your building security systems or employee data. Focus more on operational and reputational risk.
Adjust criticality thresholds to match your institution's risk appetite. A small regional bank might classify fewer vendors as critical than a multinational institution. Document your classification criteria in a separate policy so assessors apply them consistently.
Expand the subcontracting section if you operate in jurisdictions with strict outsourcing rules. Some regulators require you to treat critical subcontractors the same way you treat direct vendors, including conducting your own due diligence.
Add jurisdiction-specific requirements. If you're subject to requirements beyond the EBA guidelines, add checkboxes or sections for those. For example, if you must verify that vendors don't use forced labor in their supply chains, add that verification step.
Validation Steps
Before you consider an assessment complete:
Cross-check your criticality rating with your business continuity plan. If you've classified the vendor as critical, does your BCP reflect that? Do you have a tested workaround if they fail?
Verify that monitoring frequency matches risk level. Critical vendors with high residual risk need quarterly reviews at minimum. Low-risk vendors can go annual. If your monitoring plan doesn't match your risk rating, something's wrong.
Confirm you have contract terms for the mitigations you've listed. If you've identified that you need quarterly security assessments but your contract doesn't require the vendor to provide them, you have a gap.
Test your exit strategy assumptions. Can you actually get your data back in the format you need? Have you confirmed that alternative vendors exist and could onboard you in your stated timeline?
Get the right approvals. Risk assessments that sit in a compliance folder don't protect anyone. The business owner who relies on the vendor needs to acknowledge the residual risk they're accepting.
Store completed assessments where your audit team and regulators can find them. When a vendor relationship changes (new services, new subcontractors, control failures), pull the assessment and update it. This isn't a one-time paperwork exercise. It's the documentation that proves you knew what you were getting into and managed it deliberately.
