# Supplier Assessment Template

Version 2.0 · Updated 2026-09-21 · Assessment

Evaluate whether the supplier, service controls, lifecycle practices, and available evidence are suitable for the intended use.

Adapt this template to your intended use, applicable requirements, and approved procedures.

## When to use it

For purchased software, SaaS, cloud services, foundation models, managed platforms, and material supplier changes.

## Information needed before starting

- Defined service and release model
- Supplier quality, testing and security information
- Local responsibilities, configuration and evidence gaps

## Field instructions

- **Supplier and service:** Identify the system/service or process, version and accountable roles. Specify the scope and supporting record rather than relying on a product name alone.
- **Intended use supported:** Describe the specific task, users, outputs and decisions supported. Identify the assessed environment and limits of reliance.
- **Service and release model:** Identify the authoritative change, affected configuration and dependencies. Trace the impact to approved use, controls, evidence and the local change/approval process.
- **Lifecycle and quality evidence:** Reference the exact evidence, version, date and assessed conditions. Explain the claim it supports, how it was reviewed and what remains unproven locally.
- **Security and availability evidence:** Reference the exact evidence, version, date and assessed conditions. Explain the claim it supports, how it was reviewed and what remains unproven locally.
- **Test and defect evidence:** Reference the exact evidence, version, date and assessed conditions. Explain the claim it supports, how it was reviewed and what remains unproven locally.
- **Change notification:** Identify the authoritative change, affected configuration and dependencies. Trace the impact to approved use, controls, evidence and the local change/approval process.
- **Data and record responsibilities:** Identify the required record context, history, identity and relationships. Explain how integrity, attribution and retrieval will be preserved and checked.
- **Evidence limitations:** State what is outside the assessed use or evidence. Explain the consequence and any restriction; do not treat missing information as a pass.
- **Assessment conclusion and actions:** Record the supported decision, restrictions, unresolved issues and rationale. Identify the accountable reviewer/approver and dated evidence under your procedure.

Define the service and customer-controlled configuration.

Review evidence relevance, credibility, and coverage.

Record customer and supplier responsibilities.

Identify gaps that require contract, control, monitoring, or local testing.

## Completed fictional example

Fictional teaching example; this is not an executed or approved validation record.

| Field | Completed example |
| --- | --- |
| Supplier and service | Fictional multi-tenant eQMS provider |
| Intended use supported | CAPA creation, approval, signature, retention, and export |
| Service and release model | Weekly supplier-managed releases |
| Lifecycle and quality evidence | SDLC summary and controlled release process reviewed |
| Security and availability evidence | SOC 2 report reviewed for control context only |
| Test and defect evidence | Version-specific standard-workflow regression summary |
| Change notification | Release notes five days before production |
| Data and record responsibilities | Supplier hosts records; customer controls configuration, roles, procedures, and export use |
| Evidence limitations | No coverage of local CAPA routing or identity mapping |
| Assessment conclusion and actions | Conditionally suitable; perform configuration testing and strengthen change-notification terms |

## Blank template

System / record ID: ____________________

Prepared by / date: ____________________

Required review / approval under local procedure: ____________________

| Field | Your entry |
| --- | --- |
| Supplier and service | ____________________ |
| Intended use supported | ____________________ |
| Service and release model | ____________________ |
| Lifecycle and quality evidence | ____________________ |
| Security and availability evidence | ____________________ |
| Test and defect evidence | ____________________ |
| Change notification | ____________________ |
| Data and record responsibilities | ____________________ |
| Evidence limitations | ____________________ |
| Assessment conclusion and actions | ____________________ |

## Related guidance

- [Assess supplier evidence](https://csvtocsa.com/learn/guidance/supplier-assessment-and-evidence)

- [Review the SaaS update example](https://csvtocsa.com/case-studies/saas-eqms-weekly-releases)

- [Open Supplier Review](https://csvtocsa.com/tools/supplier-review)

Canonical page: https://csvtocsa.com/templates/supplier-assessment