Risk Management Assessment Questionnaire

RISK MANAGEMENT ASSESSMENT QUESTIONNAIRE

Client Name:   Assessor Name:   Effective Date:

WHEREAS

WHEREAS, Client wishes to engage Assessor to perform a structured risk management assessment of Client's operations, controls, and resilience measures in accordance with the terms set forth in this document; and

WHEREAS, Assessor represents that it has the experience, personnel, and processes necessary to perform the risk assessment and to provide findings and recommendations intended to reduce identified risk exposures; and

WHEREAS, the parties agree that completion of this questionnaire and any attached scopes constitutes the basis for the assessment engagement and the deliverables to be provided by Assessor to Client.

SCOPE OF WORK

ASSESSMENT QUESTIONNAIRE

A. Governance and Oversight

1. Is there documented risk management policy approved by senior management or the board?   Comments:

2. Is there a designated risk owner for major risk categories?   Reporting frequency:

3. Are key risk indicators (KRIs) defined and monitored?   Sample KRIs:

B. Operational Risk

1. Are core business processes mapped and controlled?   Process owner defined:

2. Is there a formal third-party/vendor risk management program?   Vendor due diligence type:

Findings/Notes:

C. Compliance and Legal

1. Are regulatory obligations documented and regularly reviewed?   Last compliance audit date:

Notes:

D. Information Security & IT

1. Is there an information security policy and asset inventory?

2. Are multifactor authentication and encryption applied to sensitive systems?

Security Observations:

E. Business Continuity & Resilience

1. Is there a tested business continuity plan (BCP) and disaster recovery (DR) plan?   Last test date:

Continuity Notes:

F. Insurance & Financial Controls

1. Does Client maintain insurance coverage adequate to mitigate identified risks?   Insurance types:

Financial Controls Observations:

FINDINGS AND RECOMMENDATIONS

PAYMENT TERMS

TERM AND TERMINATION

Engagement Start Date:   Engagement End Date:

Either party may terminate this engagement for material breach if the breaching party fails to cure such breach within the notice period specified above. Termination will not relieve either party of obligations incurred prior to the effective date of termination.

CONFIDENTIALITY

All information exchanged in connection with this assessment that is designated confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure (Confidential Information) shall be held in confidence by the receiving party. The receiving party shall not disclose Confidential Information to any third party except as required by law or with the prior written consent of the disclosing party. The receiving party shall apply the same protections it uses for its own confidential information but in no event less than reasonable care.

GOVERNING LAW

This Agreement and any dispute arising out of or relating to it shall be governed by and construed in accordance with the laws of the state selected by the parties at the time of execution. The parties submit to the exclusive jurisdiction of the courts located in that state for resolution of disputes.

ENTIRE AGREEMENT

This document, including the completed questionnaire and any attached scopes or statements of work, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior and contemporaneous agreements, proposals, negotiations, and communications, whether oral or written. No amendment is effective unless in writing and signed by both parties.

Acknowledgment

By signing below, the undersigned certify that the information provided in this questionnaire is true and accurate to the best of their knowledge and that they are authorized to bind the respective party to the terms herein.

Sign Now