---
title: [OR] [Pillar] [E4] [C5] TPRM Tools, Templates and Scoring Models
description: [OR] [Pillar] [E4] [C5] TPRM Tools, Templates and Scoring Models
---

[eBook OR](https://blog.bcm-institute.org/ebook-or)

# [\[OR\] \[Pillar\] \[E4\] \[C5\] TPRM Tools, Templates and Scoring Models](https://blog.bcm-institute.org/ebook-or/or-pillar-e4-c5-tprm-tools-templates-and-scoring-models)

 Written by [Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) | Apr 17, 2026 1:48:28 PM

### eBook 4: Chapter 5

### TPRM Tools, Templates, and Scoring Models

#### **Introduction**

A robust Third-Party Risk Management (TPRM) framework must be supported by practical tools, structured templates, and consistent scoring models. Without these, organisations struggle to operationalise governance, assess risks consistently, and demonstrate compliance with regulatory expectations.

Regulators such as the **Bangko Sentral ng Pilipinas (BSP)** and **Bank Negara Malaysia (BNM)** expect financial institutions to adopt a **risk-based, evidence-driven approach** to managing third-party risks. This requires standardised templates for vendor inventory, risk assessments, monitoring, and reporting—supported by quantitative scoring models.

This chapter provides **Excel-ready templates and scoring methodologies** that participants can directly apply in their organisations.

#### **Purpose of This Chapter**

By the end of this chapter, readers will:

- Use **standardised TPRM templates**
- Apply **risk scoring models** for vendor classification
- Build **dashboards and heatmaps** for reporting
- Align tools with **Operational Resilience and CBS requirements**

#### **Section 1: Core TPRM Templates (Excel-Ready)**

##### **Third-Party Inventory Register**

**Purpose**

Maintain a centralised repository of all third-party relationships.

**Template**

| Vendor ID | Vendor Name | Service Provided | Linked CBS | Criticality (H/M/L) | Contract Start | Contract End | Vendor Owner | Country | Remarks |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |

**Excel Tip:**

- Use **dropdown lists** for Criticality (High/Medium/Low)
- Apply **filters** for CBS and Vendor Owner

##### **Vendor Risk Assessment Template**

**Purpose**

Assess inherent and residual risks across key domains.

**Template**

| Risk Category | Assessment Criteria | Score (1–5) | Weight (%) | Weighted Score | Remarks |
| --- | --- | --- | --- | --- | --- |
| Operational | Service reliability |   | 20% |   |   |
| Cybersecurity | Data protection controls |   | 25% |   |   |
| Compliance | Regulatory adherence |   | 15% |   |   |
| Financial | Financial stability |   | 15% |   |   |
| Reputational | Brand impact |   | 10% |   |   |
| Concentration | Dependency level |   | 10% |   |   |
| Strategic | Alignment with business |   | 5% |   |   |
| TOTAL |   |   | 100% | Auto-calculated |   |

**Excel Formula:**

- Weighted Score = Score × Weight
- Total Risk Score = SUM(Weighted Scores)

##### **Vendor Criticality Assessment**

**Purpose**

Determine the importance of the vendor to CBS.

**Template**

| Criteria | Description | Score (1–5) |
| --- | --- | --- |
| CBS Impact | Supports critical service? |   |
| Customer Impact | Affects customers? |   |
| Regulatory Impact | Regulatory consequences? |   |
| Substitutability | Ease of replacement |   |
| Recovery Time | Time to recover service |   |

**Classification:**

- 20–25 = Critical
- 15–19 = High
- 10–14 = Medium
- <10 = Low

##### **Vendor Monitoring Dashboard**

**Purpose**

Track ongoing performance and risk indicators.

**Template**

| Vendor | KPI | Target | Actual | Variance | Risk Level | Status | Action |
| --- | --- | --- | --- | --- | --- | --- | --- |

**Excel Tip:**

- Use **conditional formatting**:

##### **Incident & Issue Log**

**Purpose**

Track third-party incidents affecting CBS.

**Template**

| Date | Vendor | Incident Type | CBS Impacted | Severity | Root Cause | Action Taken | Status |
| --- | --- | --- | --- | --- | --- | --- | --- |

##### **Exit Management Checklist**

**Purpose**

Ensure smooth vendor transition.

**Template**

| Activity | Owner | Status | Due Date | Remarks |
| --- | --- | --- | --- | --- |
| Data return/destruction |   |   |   |   |
| Transition plan |   |   |   |   |
| Contract closure |   |   |   |   |

#### **Section 2: Risk Scoring Models**

##### **Inherent Risk Scoring Model**

**Scoring Scale**

| Score | Description |
| --- | --- |
| 1 | Very Low |
| 2 | Low |
| 3 | Moderate |
| 4 | High |
| 5 | Very High |

##### **Residual Risk Calculation**

**Formula:**

**Residual Risk = Inherent Risk × (1 – Control Effectiveness %)**

**Example:**

| Vendor | Inherent Risk | Control Effectiveness | Residual Risk |
| --- | --- | --- | --- |
| Vendor A | 4.5 | 60% | 1.8 |

##### **Risk Rating Classification**

 

| Score Range | Risk Level |
| --- | --- |
| 4.0 – 5.0 | Critical |
| 3.0 – 3.9 | High |
| 2.0 – 2.9 | Medium |
| 1.0 – 1.9 | Low |

##### **Vendor Risk Heatmap**

**Template (Excel Matrix)**

| Impact ↓ / Likelihood → | Low | Medium | High |
| --- | --- | --- | --- |
| High Impact | Medium | High | Critical |
| Medium Impact | Low | Medium | High |
| Low Impact | Low | Low | Medium |

**Excel Tip:**

Use **color gradients**:

Red = Critical   
Orange = High   
Yellow = Medium   
Green = Low

#### **Section 3: TPRM Dashboard (Executive Reporting)**

##### **Sample Dashboard Metrics**

| Metric | Description |
| --- | --- |
| Total Vendors | Total number of third parties |
| Critical Vendors | Number supporting CBS |
| High-Risk Vendors | Vendors with high/critical risk |
| SLA Breaches | Number of performance breaches |
| Open Incidents | Active vendor-related issues |
| Compliance Status | % compliant vendors |

##### **Dashboard Layout (Excel)**

| Category | Metric | Value | Trend |
| --- | --- | --- | --- |
| Risk | High-Risk Vendors | 12 | ↑ |
| Performance | SLA Compliance | 95% | → |
| Incidents | Open Issues | 5 | ↓ |

**Excel Tip:**

Use **pivot tables**   
Add **charts (bar, pie, trend lines)**

#### **Section 4: Integration with Operational Resilience**

##### **Mapping Templates to OR Components**

| OR Component | TPRM Tool |
| --- | --- |
| CBS Mapping | Vendor Inventory |
| BIA | Criticality Assessment |
| Scenario Testing | Incident Log + Risk Scoring |
| Impact Tolerance | Risk Heatmap |
| Crisis Management | Incident Dashboard |

#### **Section 5: Implementation Roadmap**

##### **Step-by-Step Deployment**

| Step | Action |
| --- | --- |
| 1 | Create Vendor Inventory |
| 2 | Perform Risk & Criticality Assessment |
| 3 | Apply Scoring Model |
| 4 | Classify Vendors |
| 5 | Implement the Monitoring Dashboard |
| 6 | Conduct Scenario Testing |
| 7 | Report to Management |

#### **Key Takeaways**

- Standardised templates ensure **consistency and auditability**
- Scoring models enable **objective risk classification**
- Dashboards provide **real-time visibility for decision-making**
- Tools must align with **CBS and Operational Resilience frameworks**
- Excel-based models are **practical and scalable for implementation**

The effective management of third-party risk depends not only on frameworks and governance but also on the practical tools used to implement them.

By adopting structured templates and quantitative scoring models, organisations can transform TPRM from a theoretical concept into a measurable, actionable discipline.

These Excel-ready tools provide a foundation for consistent risk assessment, proactive monitoring, and informed decision-making—ensuring alignment with regulatory expectations, including BSP Circular No. 1203 and BNM Operational Resilience guidelines.

When integrated with Operational Resilience, these tools empower organisations to maintain the continuity of critical business services, even in the face of third-party disruptions.

 

| **C1** | **C2** | **C3** | **C4** |
| --- | --- | --- | --- |
|  |  |  |  |
| **C5** | **C6** | **C7** | **C8** |
|  |  |  |  |

#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

|  |  |  |
| --- | --- | --- |
|  |  |  |
|  | If you have any questions, click to contact us. |  |
|  |  |  |

 

[View full post](https://blog.bcm-institute.org/ebook-or/or-pillar-e4-c5-tprm-tools-templates-and-scoring-models)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Moh Heng Goh"
  },
  "dateModified" : "2026-05-20T10:00:19.205Z",
  "datePublished" : "2026-04-17T13:48:28Z",
  "headline" : "[OR] [Pillar] [E4] [C5] TPRM Tools, Templates and Scoring Models",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1350,
    "url" : "https://3893111.fs1.hubspotusercontent-na1.net/hubfs/3893111/OR%20Pillar%20E4%20Morepost/%5BOR%5D%20%5BPillar%5D%20%5BE4%5D%20%5BC5%5D%20Tools%2c%20Templates%20and%20Scoring%20Models.jpg",
    "width" : 1080
  },
  "mainEntityOfPage" : "https://blog.bcm-institute.org/ebook-or/or-pillar-e4-c5-tprm-tools-templates-and-scoring-models",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "eBook OR"
  }
}
```