Enter Vendor Inputs
Use 0–5 control ratings. Use 1–5 for most risk drivers.
Example Benchmark Table
These examples show how scores can differ across vendor tiers.
| Vendor | Criticality | Impact | Likelihood | Controls | Residual | Rating |
|---|---|---|---|---|---|---|
| Acme Analytics | 2 | 32 | 28 | 78 | 2.0 | Low |
| BluePay Processor | 4 | 78 | 62 | 60 | 19.3 | Low |
| NorthBridge MSP | 5 | 92 | 78 | 42 | 41.8 | High |
Numbers are illustrative and depend on your inputs.
Formula Used
Impact Score (0–100) = average(Criticality, Data Sensitivity, Access Level, Dependency) × 20.
Likelihood Score (0–100) blends Geographic Risk, Incident History, inverse(Security Maturity), plus exposure flags, then × 20.
Control Strength (0–100) = weighted average of control ratings (0–5) scaled to 0–100.
Inherent Risk (0–100) = (Impact × Likelihood) ÷ 100.
Residual Risk (0–100) = Inherent × (1 − ControlStrength/100).
Benchmark delta = Residual − PeerAvg. Percentile uses a normal approximation with PeerStd.
How to Use This Calculator
- Choose vendor type and criticality based on business dependency.
- Set impact drivers using data sensitivity and access level.
- Set likelihood drivers using exposure, maturity, and incident history.
- Rate controls from 0–5 using evidence and interviews.
- Select Auto benchmark or enter peer values in Custom mode.
- Submit to view residual risk and benchmark positioning.
- Download CSV or PDF for governance and audit trails.
FAQs
1) What does residual risk represent?
Residual risk estimates remaining exposure after applying control strength to the inherent risk. It helps prioritize vendors needing stronger mitigations or tighter contractual requirements.
2) How should I rate controls from 0 to 5?
Use 0 for missing controls, 3 for implemented controls, and 5 for mature controls with monitoring and metrics. Prefer objective evidence like reports, logs, and audit results.
3) What is the difference between inherent and residual risk?
Inherent risk reflects impact and likelihood before mitigations. Residual risk reduces inherent risk using control strength, showing what remains after safeguards are considered.
4) How does the benchmark percentile work?
Percentile estimates how your residual risk compares to peers. Higher percentile means higher risk than most peers. It uses a simple normal approximation based on peer average and standard deviation.
5) When should I use Custom benchmark values?
Use Custom mode when you have internal historical data, industry benchmarking, or a curated peer dataset. Enter the peer average residual and a realistic standard deviation for better comparisons.
6) Can I use this for fourth-party risk too?
Yes. Model subcontractor exposure with the subcontractors checkbox and adjust controls based on oversight. For deeper analysis, run a separate assessment for critical fourth parties.
7) How often should vendor scores be refreshed?
Refresh at least annually, and anytime scope changes, incidents occur, or new integrations are added. High criticality vendors often benefit from quarterly evidence checks.
8) Is this score a replacement for a full assessment?
No. It is a structured benchmark and prioritization tool. Use it to guide due diligence depth, contractual controls, and remediation planning alongside your existing review process.