Legal and risk / Free editable template

Third-party risk tiering pyramid template

Third-party risk management is about spending your checking effort where suppliers could do the most harm. This board sorts 572 suppliers into a four-tier pyramid, from eight critical suppliers at the top to hundreds of low-risk ones at the base, and sets out in a matrix which checks each tier gets: security questionnaires, assurance reports, financial checks, audits, data terms, exit plans and review frequency.

This is a planning example, not legal advice. Check your own policies, advisers and the local rules that apply to you.

Use this template →See the example ↓

No account needed · Opens as your own editable page

Preview the third-party risk tiering pyramid

View full-size preview ↗
Third-party risk tiering pyramid example showing four-tier supplier pyramid with counts, due diligence matrix by tier, tiering questions and a simple rule
Everything in this example is editable. Replace the labels, move the shapes and adapt the layout to your work.

How to use this template

  1. Agree the tiering questions

    Pick a few questions that show how much harm a supplier could do, such as access to personal data or how hard they are to replace.

  2. Tier every supplier

    Run each supplier through the questions and count how many land in each tier. Most should be at the base.

  3. Match checks to tiers

    Decide which checks and contract terms each tier needs and how often you review them, then apply them at onboarding and renewal.

Questions about this template

What do the filled and half-filled circles mean?

A filled circle means the check is required for that tier, a half circle means it applies if relevant and a dash means it is not needed.

Do I need an account to use it?

No. Open the template and edit it in your browser. Your work saves on this device. An account is optional if you want to sync your workspace.

Can I export the finished diagram?

Yes. Use Export in the editor to save a PNG, SVG or PDF, or download an editable .epicdraw backup.

More Legal and risk templates →