⚡ Quick Summary
Published by FS-ISAC, this February 2024 white paper sets out the purpose and methodology of the Generative Artificial Intelligence Vendor Evaluation and Risk Assessment workbook, a Microsoft Excel tool for assessing and selecting generative AI (GenAI) vendors while managing associated risks. It addresses financial institutions (FIs) of different sizes and complexities and is designed to supplement existing third-party risk management (TPRM) processes rather than replace them.
The workflow has five steps. Users enter vendor information, then complete an initial risk analysis that scores five domains — the organisation's use case, business integration, use of confidential data, business resiliency and potential for exposure — where the highest score determines a Level 1, 2 or 3 due diligence plan. An optional internal stakeholder questionnaire follows, then a dynamic vendor questionnaire covering discovery, data privacy and retention, model training and validation, information security, technology integration, Nth party risk, and legal, regulatory and compliance matters. Responses auto-populate a final report that can be printed to PDF as a point-in-time due diligence record.
The paper states that the responses do not yield a risk rating and that FIs should apply their own risk-rating methodologies.
🧩 What’s Covered
- Overview and methodology: the workbook's purpose — helping financial institutions assess and select GenAI vendors — and two ways to use the model: a starting point for comprehensive due diligence, or a complete process for more modest processes and higher risk appetites.
- Workbook structure: four worksheets — assessment model, stakeholder questionnaire, vendor questionnaire and final report — with a recommendation to save a copy so the defaults are preserved.
- Assessment model: five steps, from entering vendor information that auto-populates the other worksheets, through the initial risk analysis that scores five domains at risk levels 1, 2 or 3 to set the recommended due diligence plan, to approving questions for each questionnaire and customising Additional Considerations.
- Due diligence levels: Level 1 covers basic risks for R&D or educational use (foundational model, data privacy notices, information security, API integration, Nth party risk); Level 2 adds legal, regulatory and compliance, vulnerability management, model validation and vendor moderation; Level 3 adds data retention, change management, audit validation, security configuration, log management, DLP and technology integration.
- Preparing to send the questionnaires: AutoFit Row Height in Column B and across all final-report columns, hiding excluded questions with column filters, and hiding worksheets from recipients — which the paper stresses is not a security control.
- The final report and archiving: an auto-populated worksheet combining risk analysis, stakeholder responses, vendor responses and Additional Considerations, printed to PDF with "Print Active Sheets" as a point-in-time record.
- Periodic re-assessment: save a new working copy, repeat the workflow and save a new PDF, as often as policy requires.
💡 Why it matters?
For third-party risk, compliance and security teams, the guide provides a repeatable way to tier GenAI vendor due diligence by risk rather than applying one questionnaire to every engagement. It ties the questionnaires to recognised sources — NIST's AI Risk Management Framework 1.0, NIST CSF, the FFIEC IT Examination Handbook and the FFIEC's 2023 Interagency Guidance on Third-Party Relationships — and notes that the FFIEC guidance specifically addresses novel risks. The final report is intended as a documented point-in-time due diligence record that can support internal risk rating, audit and supervisory review of GenAI adoption.
❓ What’s Missing
The white paper itself contains no questionnaire questions, thresholds or weights; the substantive content sits in the accompanying Excel workbook, which is not part of this PDF. It states that responses do not produce a risk rating and that future iterations may seek to quantify risk, so scoring remains manual. Coverage is explicitly partial: the model does not address all use cases, risks or risk appetites, and the authors caution that GenAI, regulation and vendor offerings change quickly. Practical instructions assume Microsoft Excel and note that views differ by version or operating system, and the regulatory references are US-oriented.
👥 Best For
Third-party risk and vendor risk managers at financial institutions building or refreshing GenAI due diligence, TPRM programme owners tailoring questionnaire tiers to their risk appetite, and internal audit, compliance or information security staff who need a documented, repeatable assessment record for generative AI vendors.
📄 Source Details
Generative AI Vendor Risk Assessment Guide, published by FS-ISAC, February 2024, marked TLP:WHITE. White paper, 14 pages, English, no version or reference number printed. Contributors are listed with their employers on page 13, with Benjamin Dynkin as Group Chair and Hiranmayi Palanki as Vice Chair; no authors are credited. References point to the White House fact sheet on the 30 October 2023 Executive Order and to fsisac.com. The full 14-page text extraction was available.
