# Assess a vendor's due diligence responses for third-party risk

Reviews a vendor's questionnaire answers and evidence, flags gaps and red flags, and recommends a risk rating and contract conditions.

- Topic: Legal & Compliance
- Framework: Few-Shot
- Level: Standard
- Tags: Legal, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/assess-a-vendor-s-due-diligence-responses-for-third-party-risk

## Prompt

```text
Help me assess a third party's risk from their due diligence responses.

**Vendor and service:** [WHAT they will do for us]
**Data and access they will have:** [e.g. customer personal data, payment data, network access, none]
**Criticality:** [how much would a failure or outage hurt us]
**Their questionnaire answers and evidence:** [PASTE - security questionnaire, certifications, policies, financials]
**Our risk areas to cover:** [e.g. information security, privacy, business continuity, financial stability, anti-bribery, sanctions, subcontractors, ESG]
**Our risk appetite or tiering rules:** [PASTE if available]

Review and return:
1. **Inherent risk tier** - based on data, access, and criticality, with the reasoning.
2. **Assessment table** - columns: Risk area, What they claim, Evidence provided, Gap or concern, Severity (High/Medium/Low).
3. **Red flags** - vague or copy-paste answers, missing evidence, expired certifications, certification scope that excludes this service, heavy reliance on undisclosed subcontractors, inconsistent answers.
4. **Follow-up questions** to send the vendor, specific and answerable.
5. **Contract conditions to request** - e.g. audit rights, breach notification timelines, data return and deletion, subcontractor approval, insurance, service levels.
6. **Recommended outcome** - approve / approve with conditions / escalate / decline, with residual risk stated.

Do not assume a control exists because a policy is mentioned. Treat unanswered questions as gaps. Have legal review contract terms.
```

## What to fill in

- WHAT they will do for us
- how much would a failure or outage hurt us
- PASTE if available

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.