Vendor inventory quality drives scoring accuracy
Start with a complete supplier list and consistent scopes. In practice, teams miss 10–20% of indirect vendors because renewal owners change. Capture the service name, business owner, and data pathways before rating factors. When the scope is clear, the 0–5 inputs map cleanly to the 0–100 impact and likelihood scores. Use the notes field to reference contracts, tickets, and evidence dates for future reviews. Reconcile invoices monthly to catch new suppliers early again.
Impact factors align to business harm
Impact is calculated from four elements: data sensitivity, access level, criticality, and regulatory exposure. Default weights are 0.35, 0.25, 0.25, and 0.15, and the tool normalizes any custom weights to sum to 1. If a vendor holds regulated PII and has privileged access, the impact score typically exceeds 60. Treat impact as the “blast radius” that leadership understands. Document assumptions so reviewers reproduce scores during audits easily.
Likelihood highlights control gaps and exposure
Likelihood blends exposure, incident history, subcontractor reliance, geographic risk, and a control gap defined as 5 minus control maturity. The default control-gap weight is 0.30, making evidence of mature controls a strong lever. A vendor with medium exposure (3) but weak maturity (1) produces a gap of 4, often pushing likelihood above 55. Track reported incidents and their remediation timelines to avoid stale ratings. Use threat intelligence updates when exposure ratings change materially.
Residual risk connects assurance to decisions
Inherent risk is a configurable blend of impact and likelihood, defaulting to 45% impact and 55% likelihood. Residual risk then applies a reduction based on assurance evidence, contract strength, and mitigation plan strength. The reduction is capped at 35%, preventing “paper compliance” from masking real exposure. For high tiers, require breach notice windows, right-to-audit language, and measurable remediation milestones. Escalate exceptions when residual risk stays above target thresholds.
Operationalizing tiers and review cadence
Residual scores map to tiers: Low under 25, Moderate 25–49, High 50–74, and Critical 75+. The calculator recommends Annual, Biannual, Quarterly, or Monthly reassessment accordingly. Use the saved register to monitor drift after mergers, hosting moves, or new integrations. Export CSV to share with procurement and risk committees, and keep PDF summaries for approvals and exceptions in your governance workflow. Record review dates to prove continuous oversight to regulators.