How to use: adapt this template to your organisation's jurisdictions, sector, risk appetite and delegation of authority. Assign accountable owners and obtain legal or specialist review where required.
| Factor | Low | Medium | High | Critical |
|---|---|---|---|---|
| Service criticality | Non-critical | Important | Business-critical | Safety or systemic |
| Data access | None | Business data | Personal/confidential | Privileged or sensitive at scale |
| Spend/exposure | Low | Moderate | High | Concentration or material |
| Due diligence | Identity | Identity + financial | Specialist modules | Enhanced review + executive approval |
| Review cadence | 36 months | 24 months | 12 months | 6 months/event-driven |
Related: Vendor onboarding policy guide · Risk-tiering framework · Vendor master governance
General information only, not legal advice. Verify requirements with the relevant competent authority and qualified advisers.