CSV template · version 2026-10-11
Vendor risk scoring matrix
Use the matrix to document inputs, evidence, calculations, owners, and decisions without hiding the formula.
Scoring anchors
| Level | Impact anchor | Likelihood anchor |
|---|---|---|
| 1 | Minimal effect | Rare |
| 2 | Limited, recoverable effect | Unlikely |
| 3 | Material operational effect | Possible |
| 4 | Major service, data, or legal effect | Likely |
| 5 | Severe or systemic effect | Almost certain |
What the file includes
Vendor, impact, likelihood, control effectiveness, inherent score, residual score, band, evidence reference, reviewer, decision, and review date.
Example
A vendor rated impact 4 and likelihood 3 has an inherent score of 48. With 25% effective controls, the residual score is 36 and the band is Moderate.
Review controls
Lock formula columns, require evidence references, record assumptions, and keep approval separate from the calculated rating.
Use the calculator and read the full methodology.