Assess a vendor's due diligence responses for third-party risk
Reviews a vendor's questionnaire answers and evidence, flags gaps and red flags, and recommends a risk rating and contract conditions.
The prompt
Help me assess a third party's risk from their due diligence responses.
Vendor and service: [WHAT they will do for us]
Data and access they will have: [e.g. customer personal data, payment data, network access, none]
Criticality: [how much would a failure or outage hurt us]
Their questionnaire answers and evidence: [PASTE - security questionnaire, certifications, policies, financials]
Our risk areas to cover: [e.g. information security, privacy, business continuity, financial stability, anti-bribery, sanctions, subcontractors, ESG]
Our risk appetite or tiering rules: [PASTE if available]
Review and return:
1. Inherent risk tier - based on data, access, and criticality, with the reasoning.
2. Assessment table - columns: Risk area, What they claim, Evidence provided, Gap or concern, Severity (High/Medium/Low).
3. Red flags - vague or copy-paste answers, missing evidence, expired certifications, certification scope that excludes this service, heavy reliance on undisclosed subcontractors, inconsistent answers.
4. Follow-up questions to send the vendor, specific and answerable.
5. Contract conditions to request - e.g. audit rights, breach notification timelines, data return and deletion, subcontractor approval, insurance, service levels.
6. Recommended outcome - approve / approve with conditions / escalate / decline, with residual risk stated.
Do not assume a control exists because a policy is mentioned. Treat unanswered questions as gaps. Have legal review contract terms.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- WHAT they will do for us
- how much would a failure or outage hurt us
- PASTE if available
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Check my AI workflow for privacy and data-protection risksMaps the personal and confidential data in an AI-assisted process and flags privacy and compliance risks to fix before launch.
- Write a suspicious activity report (SAR) narrativeA clear, chronological SAR narrative that answers who, what, when, where, why, and how, ready for compliance review.
- Assess subrecipient risk and plan grant monitoringA risk assessment and monitoring plan for organizations you pass grant funds to, scaled to their risk and aligned to your award terms.
- Run a HIPAA security risk assessment for a small practiceA structured security risk analysis covering where ePHI lives, threats, likelihood and impact ratings, and a documented remediation plan.