Learn how to prepare a professional third-party risk assessment report, summarise supplier due diligence findings, evaluate residual risk, document evidence gaps and present clear recommendations to business owners and management. Includes a completed example report and practical exercise.
You are a GRC analyst at Meridian Financial Services, a fictional UK fintech company.
The organisation wants to onboard a new customer support platform.
Over the past two weeks, you have:
Your manager now asks:
"Can you prepare a report for the Head of Operations so that we can decide whether to proceed with the supplier?"
You have a spreadsheet containing risk scores, a completed questionnaire, several assurance documents, an evidence log and a remediation tracker.
But management does not necessarily need to read every document.
It needs to understand the supplier's importance, the significant risks, the evidence supporting your conclusions, the outstanding issues and the decisions required.
This is the purpose of a third-party risk assessment report.
In this guide, you will learn how to turn detailed supplier assurance work into a clear, evidence-based report that helps authorised stakeholders make informed decisions.
A Third-Party Risk Assessment Report is a documented evaluation of risks associated with a supplier relationship, supported by relevant information and assurance evidence.
It communicates the outcome of a supplier assessment to those responsible for managing or approving the relationship.
Depending on the organisation, the report may be part of a GRC platform, a standardised document, an assessment record or a formal management paper.
The exact format can vary.
However, a useful report should answer six questions:
The report should provide enough information for management to understand the assessment without unnecessarily repeating the entire working file.
Supplier assessments may involve a significant volume of information.
For example, a High-impact technology supplier may provide:
These documents support the assessment, but they are not themselves a final risk conclusion.
A GRC analyst must interpret the evidence and explain its implications for the organisation.
Good supplier reporting helps to:
The purpose of the report is not to prove that the GRC analyst completed a large amount of work. It is to communicate the results of that work clearly.
Different stakeholders need different levels of detail.
Usually wants to understand:
May need:
May need:
Usually needs:
A practical approach is to put the decision-relevant information at the beginning and retain detailed evidence references later in the report.
For GRC Workshop, we will use a reusable structure containing twelve sections.
| Section | Purpose |
|---|---|
| 1. Report information | Version, date, scope and reviewers |
| 2. Executive summary | Overall assessment and required decision |
| 3. Supplier profile | Service, owner, information and dependencies |
| 4. Assessment scope and methodology | What was reviewed and how |
| 5. Supplier criticality | Impact tier and justification |
| 6. Inherent risk assessment | Key risk scenarios before controls |
| 7. Due diligence and evidence | Evidence reviewed and assurance coverage |
| 8. Material findings | Weaknesses, exceptions and evidence gaps |
| 9. Residual risk | Remaining exposure and appetite position |
| 10. Treatment and conditions | Actions, owners and deadlines |
| 11. Recommendation and decision | Proposed disposition and approval |
| 12. Appendices and references | Supporting records and evidence |
A short assessment may combine several sections.
A complex High-impact relationship may require greater detail.
The important requirement is that the report remains understandable and traceable.
Before preparing the report, confirm what has actually been assessed.
A supplier may provide several services, operate multiple legal entities or support different technical environments.
Your report should identify the specific relationship under review.
Supplier: SupportBridge Ltd, a fictional SaaS provider.
Service: Customer support platform.
Business owner: Head of Customer Operations.
Scope: Customer support application, relevant customer records, API integration, material hosting dependencies and supporting security controls.
Excluded: Unrelated supplier products and corporate services outside the purchased arrangement.
If the report is titled SupportBridge Security Assessment, management might assume the entire supplier organisation has been assessed.
A more accurate scope statement explains that the conclusion relates to the particular service and evidence reviewed.
An assessment conclusion should not imply coverage beyond the actual assessment scope.
The executive summary is often the most important part of the report.
It should enable a decision-maker to understand the assessment quickly.
A useful summary covers:
A third-party risk assessment was completed. The supplier answered 112 questionnaire questions and provided multiple documents. Several issues were identified. The supplier should improve its security.
This is vague.
It does not explain the risk, business implications or required decision.
SupportBridge is a High-impact supplier because it will process customer information and integrate with Meridian's customer management system. Due diligence identified a confirmed privileged-access MFA weakness and an unresolved access-review exception. Relevant audit logging and other controls provide some assurance, but the current residual risk remains High and exceeds Meridian's normal risk appetite. I recommend withholding affected privileged production access until remediation is verified. Any proposed alternative should be assessed and referred to the designated risk authority. Final supplier approval remains pending.
This summary is stronger because it explains what matters and what should happen next.
Do not say:
The supplier is fully secure.
Or:
The supplier meets all cybersecurity requirements.
Unless a precisely defined scope and evidence genuinely support the statement, such wording overstates the conclusion.
Prefer language that identifies the actual coverage and limitations of the assessment.
The supplier profile provides essential context.
It should contain information relevant to understanding the relationship.
| Field | Example |
|---|---|
| Supplier ID | SUP-014 |
| Supplier name | SupportBridge Ltd |
| Service | Customer support SaaS |
| Business owner | Head of Customer Operations |
| Primary business process | Customer support and complaint handling |
| Information processed | Customer contact and complaint records |
| System integration | Restricted CRM API |
| Delivery model | Cloud-hosted SaaS |
| Material subcontractors | External hosting provider |
| Supplier tier | High impact |
| Assessment type | Pre-onboarding |
| Assessment date | 28 October 2026 |
The profile should not contain unnecessary personal information or sensitive security configuration details.
Sensitive supporting material should be handled according to the organisation's information classification requirements.
Readers should understand how the conclusions were reached.
A methodology section should describe:
The assessment considered the proposed supplier service, business dependency, information handling, systems access and relevant subcontractor arrangements. Inherent risk scenarios were evaluated using Meridian's approved fictional five-by-five likelihood and impact methodology. Relevant controls were assessed through supplier questionnaire responses, independent assurance documents and additional supporting evidence. Current residual risk conclusions reflect controls supported by the evidence reviewed. Unresolved evidence limitations and confirmed deficiencies are documented separately.
This establishes the basis of the report.
For example:
The assessment did not include an independent penetration test commissioned by Meridian. Technical control conclusions rely on the scoped supplier evidence and available independent assurance reports.
A limitation is not automatically a reason to reject the supplier.
It helps decision-makers understand the confidence and boundaries of the conclusions.
Supplier criticality describes the importance of the relationship and the potential consequences of supplier failure or compromise.
Do not confuse it with the supplier's security maturity.
SupportBridge is classified as High impact because:
This classification supports the level of due diligence required.
It does not mean that SupportBridge necessarily has weak security controls.
The report should identify the classification methodology and the business owner who validated the impact assumptions.
A supplier report should focus on credible risks relevant to the relationship.
Avoid presenting a long list of generic security threats without explaining their relevance.
| Risk ID | Scenario | Inherent rating |
|---|---|---|
| TPR-001 | Unauthorised access to customer support records | Critical |
| TPR-002 | Misuse of the CRM API integration | High |
| TPR-003 | Prolonged support platform disruption | High |
Each scenario should link to a supporting risk assessment record containing the likelihood, impact, assumptions and rationale.
A weak statement might say:
Inadequate access control.
This describes a possible condition, not a complete risk scenario.
A stronger statement is:
Because the supplier integrates with Meridian's customer management system, compromise or misuse of privileged integration access could allow unauthorised access to customer records, causing customer harm and operational or regulatory consequences.
This provides useful context for management.
This section should show which evidence informed the assessment.
Examples include:
However, the number of documents reviewed is not an assurance rating.
The report should indicate what relevant conclusions the evidence supports.
| Evidence | Conclusion | Limitation |
|---|---|---|
| Security questionnaire | Supplier control arrangements described | Responses require corroboration where material |
| ISO 27001 certificate | Current certificate verified | Scope does not clearly cover purchased SaaS service |
| SOC 2 Type 2 report | Relevant examination of the SaaS platform | Historical reporting period and identified exception |
| MFA configuration extract | Production MFA coverage assessed | Two privileged accounts are not covered |
| Recovery test record | Successful service restoration demonstrated | Must be compared with business recovery requirements |
The supporting evidence should be referenced rather than unnecessarily copied into the body of the report.
This section requires careful judgement.
The analyst should distinguish confirmed deficiencies, evidence gaps and control exceptions.
| Finding type | Meaning |
|---|---|
| Confirmed control weakness | Evidence establishes an inadequate or missing required control |
| Evidence gap | Available evidence is insufficient to support a required conclusion |
| Control exception | A documented deviation from expected control operation |
| Contractual gap | A required contractual provision is missing or inadequate |
| Unresolved dependency | A material supplier or fourth-party dependency requires further assessment |
| ID | Finding | Assessment | Action |
|---|---|---|---|
| F-001 | Two privileged production accounts lack MFA | Confirmed weakness | Implement and verify MFA |
| F-002 | One required quarterly access review was completed late | Control exception | Review cause and corrective action |
| F-003 | ISO certificate does not clearly cover the purchased SaaS service | Assurance scope limitation | Obtain service-relevant assurance |
Avoid automatically translating every assurance gap into a confirmed control failure.
For each material finding, include:
Residual risk is the exposure remaining after relevant controls have been considered.
A report should clearly distinguish:
Meridian uses a fictional five-by-five risk scoring method.
| Risk ID | Inherent | Current residual | Proposed target |
|---|---|---|---|
| TPR-001 | Critical (16) | High (12) | Moderate (8) |
| TPR-002 | High (15) | Moderate (10) | Moderate (10) |
| TPR-003 | High (12) | Moderate (9) | Moderate (9) |
The example ratings reflect a fictional documented assessment, not automatic mathematical reductions.
For TPR-001, the target rating assumes successful implementation and verification of the missing privileged-access controls.
Until remediation is verified and the risk reassessed, the current residual rating remains High.
Suppose Meridian's approved fictional policy requires escalation of all High residual risks.
The report should state:
TPR-001 remains High and exceeds Meridian's normal risk appetite. The issue requires treatment and escalation through the designated risk authority.
If management authorises an exception, the underlying appetite breach remains recorded.
A risk acceptance decision does not automatically eliminate exposure or change the assessed rating.
A recommendation is more useful when it identifies specific actions.
For each material finding, record:
| Action | Owner | Verification | Status |
|---|---|---|---|
| Enforce MFA on remaining privileged accounts | Supplier Security Manager | Production configuration evidence | Open |
| Review delayed privileged access assessment | Supplier IAM Lead | Root cause and completed corrective action | In progress |
| Obtain service-relevant assurance evidence | Supplier relationship owner | Reviewed report or equivalent evidence | Pending |
The report should distinguish actions required before onboarding from actions that can be completed later under an approved conditional arrangement.
Do not assume that a supplier's proposed remediation timetable automatically makes an unacceptable risk acceptable.
The GRC analyst should explain the available options and recommend an appropriate course of action.
Common recommendation categories include:
These labels are illustrative. The organisation's actual approval categories and delegated authorities take precedence.
A good recommendation should:
I recommend deferring unconditional approval of SupportBridge because the current residual risk associated with privileged access remains High and exceeds Meridian's normal appetite. The supplier should remediate the identified MFA deficiency and provide suitable verification evidence before affected privileged production access is enabled. Any proposed interim arrangement should undergo further assessment and be referred to the authorised risk decision-maker. Other outstanding assurance limitations should be resolved or appropriately dispositioned before final approval.
This is a decision-oriented recommendation.
It does not assert that GRC independently owns or accepts the risk.
The report may contain a recommendation before a decision has been made.
These are different statuses.
GRC recommendation: The outcome proposed by the analyst or assessment team.
Risk owner decision: The decision made by an accountable business owner within delegated authority.
Formal risk acceptance: A documented authorisation to retain identified exposure where permitted.
Supplier approval: Permission to proceed with the relationship under defined conditions.
The report should not present an unapproved recommendation as an authorised decision.
| Field | Example |
|---|---|
| Supplier | SupportBridge |
| Recommendation | Defer unconditional approval |
| Material residual risk | High |
| Appetite position | Exceeds normal appetite |
| Required treatment | MFA remediation and evidence verification |
| Decision authority | Designated supplier risk authority |
| Decision | Pending |
| Conditions | No affected privileged production access before verified treatment or properly authorised alternative |
| Review trigger | Remediation evidence or material change |
| Next review | Following verification and risk reassessment |
Once the decision is made, the report should record the date, authority, conditions and references to supporting approvals.
The following fictional report demonstrates how the individual components fit together.
Supplier: SupportBridge Ltd
Supplier ID: SUP-014
Organisation: Meridian Financial Services
Report reference: TPRM-2026-014
Version: 1.0
Assessment date: 28 October 2026
Assessment type: Pre-onboarding
Status: Assessment completed; supplier approval pending
Classification: Internal Confidential
SupportBridge Ltd is a proposed High-impact SaaS supplier providing customer support and complaint management capabilities.
The relationship will involve customer information processing and API integration with Meridian's internal customer management system.
The supplier has provided security questionnaire responses and relevant assurance documents. These support several control conclusions, including logging and recovery arrangements.
However, the assessment confirmed that two relevant privileged production accounts lack MFA. An access-review exception also requires corrective action, and the supplier's ISO 27001 certification scope does not clearly cover the purchased service.
The highest current residual risk is High, exceeding Meridian's normal appetite.
Recommendation: Defer unconditional approval and restrict the affected privileged production access pending verified remediation or an appropriately authorised alternative.
| Item | Details |
|---|---|
| Service | Customer support and complaint management SaaS |
| Business owner | Head of Customer Operations |
| Data | Customer contact details and complaint records |
| Integration | Restricted CRM API |
| Hosting | External cloud provider |
| Criticality | High impact |
| Substitutability | Replacement requires planned migration |
The assessment covered the purchased customer support service, relevant information processing, integration access, security controls and material hosting dependencies.
Unrelated supplier products were excluded.
The assessment used Meridian's fictional five-by-five likelihood and impact method.
Information was gathered from supplier documentation, questionnaire responses, independent assurance and relevant technical evidence.
The report distinguishes verified control weaknesses from evidence gaps and identifies limitations affecting confidence.
Classification: High impact.
Justification:
| Risk | Likelihood | Impact | Score | Rating |
|---|---|---|---|---|
| TPR-001: Unauthorised customer information access | 4 | 4 | 16 | Critical |
| TPR-002: CRM API misuse | 3 | 5 | 15 | High |
| TPR-003: Service disruption | 3 | 4 | 12 | High |
The supplier provided:
The ISO 27001 certificate's scope does not clearly cover the purchased SaaS service.
The SOC 2 report provides relevant historical assurance within its stated scope and examination period.
F-001: Privileged MFA deficiency
Two in-scope privileged production accounts do not enforce MFA.
Status: Confirmed control weakness.
Action: Implement MFA and provide verification evidence.
F-002: Delayed privileged access review
One review was completed outside the defined timeframe.
Status: Control exception.
Action: Confirm root cause, consequence and corrective action.
F-003: Certification scope limitation
The supplied ISO 27001 certificate does not clearly cover the purchased service.
Status: Assurance limitation.
Action: Request relevant additional assurance or clarification.
| Risk | Inherent | Current residual | Target |
|---|---|---|---|
| TPR-001 | Critical (16) | High (12) | Moderate (8) |
| TPR-002 | High (15) | Moderate (10) | Moderate (10) |
| TPR-003 | High (12) | Moderate (9) | Moderate (9) |
Current residual conclusions are based on relevant controls supported by available evidence.
The proposed TPR-001 target risk assumes successful MFA remediation and verification.
The High current residual rating exceeds Meridian's normal risk appetite.
| Action | Responsible party | Completion criterion |
|---|---|---|
| Remediate privileged MFA gap | SupportBridge Security | Verified coverage of in-scope privileged accounts |
| Address access-review exception | SupportBridge IAM | Root cause and corrective action reviewed |
| Resolve assurance scope limitation | Supplier relationship owner | Adequate service-relevant assurance reviewed |
Defer unconditional approval pending material remediation and assurance review.
Do not enable the affected privileged production access before verified remediation or an alternative expressly authorised through the relevant governance process.
Refer any proposed acceptance of High residual exposure to the designated risk authority.
GRC recommendation: Defer unconditional approval.
Business risk owner: Head of Customer Operations.
Authorised risk decision: Pending.
Supplier approval: Pending.
Next review: Following remediation evidence and updated residual risk assessment.
It demonstrates a clear chain of reasoning:
Supplier relationship → business dependency → risk scenarios → control evidence → findings → residual exposure → treatment → recommendation → authorised decision.
The information is concise enough for management but retains references that can be followed into the underlying assessment records.
Technical findings should be translated into meaningful business language without losing accuracy.
MFA is bad.
This is vague.
Two privileged production accounts do not enforce MFA, contrary to Meridian's access-control requirement.
This explains the observation.
Two supplier privileged production accounts do not enforce required MFA. If an affected account is compromised, unauthorised administrative activity could affect customer information or service availability. The supplier should remediate the deficiency and provide suitable production evidence before the affected privileged access is enabled.
This adds the potential consequence and required action.
It does not claim that a compromise has occurred.
Numerical scores can be useful, but they should not dominate the report.
Suppose one supplier has a risk score of 12 and another has a score of 15.
You cannot automatically conclude that the second represents precisely 25% more risk.
A five-by-five risk matrix generally uses ordinal categories.
Its numerical outputs support classification and prioritisation, not precise measurement of probability or expected financial loss.
Always explain the underlying risk scenario, assumptions, controls and consequences.
A supplier might perform well across many control questions but have one serious deficiency affecting privileged production access.
An overall questionnaire score of 92% should not automatically override that material weakness.
The report should give appropriate prominence to significant exposures and mandatory requirements.
A supplier assessment may be incomplete because some evidence cannot yet be obtained.
The report should clearly identify what is known and unknown.
Supported: The supplier provided relevant evidence of successful backup restoration testing.
Evidence gap: The organisation has not received sufficient evidence establishing MFA coverage for all production privileged accounts.
Confirmed weakness: Two named in-scope privileged accounts have been verified as lacking MFA.
Uncertainty: The full exposure arising from an excluded subcontractor has not yet been established.
These statements communicate different levels of assurance.
A report that treats all four as equivalent deficiencies can mislead management.
The analyst should also identify whether unresolved uncertainty affects the ability to recommend approval.
The underlying evidence should remain consistent, but its presentation may vary.
Focus on:
Provide:
Explain:
Explain:
Different reporting formats should not produce contradictory risk conclusions.
You are a junior GRC analyst at Meridian Financial Services.
The organisation is considering a new SaaS provider called DataBridge Analytics.
The supplier will process confidential business information and integrate with Meridian's reporting platform.
| Risk ID | Scenario | Rating |
|---|---|---|
| TPR-101 | Unauthorised disclosure of confidential financial information | Critical (20) |
| TPR-102 | Misuse of reporting API credentials | High (15) |
| TPR-103 | Prolonged reporting service outage | High (12) |
Finding F-101: MFA is not enforced for one privileged production account. The deficiency is confirmed.
Finding F-102: The supplier's SOC 2 Type 2 report covers the purchased service but identifies a vulnerability remediation exception requiring follow-up.
Finding F-103: The supplier has provided a backup policy, but recovery test evidence for the purchased service has not been supplied.
The assessment team provisionally concludes:
| Risk | Current residual |
|---|---|
| TPR-101 | High (15) |
| TPR-102 | Moderate (10) |
| TPR-103 | High (12) |
Meridian's fictional policy requires escalation for High residual risks.
The supplier has agreed to address the MFA weakness within thirty days.
The business wants to begin using the service in fourteen days.
Prepare a complete supplier risk assessment report containing:
| Assessment criterion | Marks |
|---|---|
| Executive summary and decision clarity | 15 |
| Scope, methodology and supplier context | 15 |
| Evidence interpretation | 20 |
| Risk analysis and appetite assessment | 20 |
| Treatment, ownership and verification | 20 |
| Report structure and professional communication | 10 |
| Total | 100 |
A strong report should make clear that:
One defensible recommendation would be to defer unrestricted implementation until material exposure and assurance issues are appropriately addressed.
If an interim arrangement is proposed, it must be assessed against applicable requirements and referred for the necessary authorisation.
The opening should prioritise material risks and decisions.
Findings should connect conditions to credible events and consequences.
Assurance uncertainty should be distinguished from established deficiencies.
Reporting should reflect impact, business context and risk appetite.
Planned controls do not automatically change current residual exposure.
Material control weaknesses should remain visible.
If important issues remain, the report should explain their implications and treatment.
The decision record should identify the authorised approver.
A finding without an actionable treatment plan may remain unresolved.
Another reviewer should be able to trace important conclusions to the supporting assessment records.
Before submitting a supplier risk assessment report, confirm:
A third-party risk assessment report should translate detailed due diligence work into information that supports management decisions.
A good report explains the supplier relationship, material exposures, assurance evidence, findings, residual risks and recommended actions.
It should clearly distinguish confirmed weaknesses from evidence gaps and current residual risk from target risk.
Numerical scores should be supported by context and professional judgement.
The executive summary should identify the significant issues and required decision.
GRC analysts provide evidence-based recommendations while respecting established risk ownership and approval authority.
An effective supplier risk report does not simply tell management whether a supplier passed or failed. It explains the exposure, the supporting evidence, the options available and the decision that needs to be made.
Next lesson: Using the TPRM Toolkit — A Practical Guide for GRC Analysts
You have now covered the major activities involved in a supplier risk assessment, from initial classification through to reporting and management recommendations.
The next guide will bring these activities into a connected practical workflow using the GRC Workshop TPRM Toolkit.
You will learn how the supplier inventory, criticality assessment, risk register, evidence review log, findings tracker, treatment records and management reports work together.
The toolkit guide should be published once the workbook has been developed, tested and approved.