What it is
The firm is responsible for data it gives a vendor. A register that ranks vendors by criticality and data access and schedules reviews makes oversight routine.
Each vendor gets criticality, data access, contract dates, whether an independent controls report is on file with its period end, the questionnaire date and the last review. Review frequency comes from a table by criticality, next review and contract notice windows are computed, and flags show missing evidence and overdue reviews.
When to use it
- After onboarding vendors.
- Quarterly oversight meetings.
- Contract renewal planning.
What’s inside
- 60 vendors with criticality and data access
- Settings table of review months by criticality
- Next review and renewal alert formulas
- Summary by criticality
Standard cited
This template follows 16 CFR 314.4(f). It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
How is review frequency chosen?
You enter months for each criticality on the Settings tab. The register looks it up.
What is flagged as missing evidence?
A vendor with client confidential or restricted access with no independent report and no questionnaire.
Does the register replace contracts?
No. It tracks status. Contract terms live in the contract.
Related templates
- Vendor Due Diligence Questionnaire for CPA Firms
- Vendor Management and Service Organization Checklist
- Service Organization Report Review Checklist (User Auditor)
- Firm Technology and Data Inventory Register (Excel)
Last updated 11/05/2026. All free templates.