Third-Party and Vendor Assurance Assessment for Procurement, Security and Risk TeamsThe question is never whether to check a supplier. It is where the twenty hours go.

Methodology: Thirty-six original exercises across six formats: sixteen slider allocations across four arrangements, six keyed single-choice items, six select-every-that-applies exercises, four keyed claims, two matching exercises and two ordering exercises. The declared response instruction is applied judgement throughout - what share of a fixed review you would spend, and what a piece of evidence establishes - and one instruction covers the whole form. Construct statement: it measures whether somebody directs assurance effort at where the exposure actually is, what they take a certificate or a questionnaire to have established, which contract terms they treat as controls rather than as compensation, and how they respond when a third party fails. It does not test any named standard, framework, certification scheme or regulation, it does not certify anybody as an assessor, and it says nothing about whether any particular supplier is safe to use. Scoring is an expert-vector allocation match. The sixteen allocations are scored as the correlation between the respondent's profile and a reference allocation, so the level of effort drops out and only the shape is scored: allocating more everywhere costs nothing and earns nothing, and an even share across all sixteen has no shape, is given no figure, and is reported as such in plain words rather than placed at the middle of the scale. The correlation is chance-corrected by simulation against the authored answer distribution on each slider, in which the even twenty-five per cent carries the largest share of the mass because that is what people actually answer. The reference allocation is authored from published risk criteria - data sensitivity, substitutability, access and concentration - rather than from a panel of raters, and the report says so: an expert vector properly wants five or more raters with reported agreement, no such panel has sat, and until one has the reference is a declared assumption printed on the page with its four profiles visible. Every other strand is chance-corrected against the authored option priors. Constructs and sources: risk-based supplier segmentation by data sensitivity, criticality and substitutability; the distinction between assertion, description and test in assurance evidence, and the scope-and-date limits of a third-party attestation report; subprocessor disclosure and the transitivity of dependency; concentration risk and shared underlying dependencies across nominally independent suppliers; incident notification windows as a determinant of containment time rather than of liability; exit planning and the difference between a termination right and an available destination; expert-profile matching scored as a correlation so that elevation and scatter drop out (the profile-similarity literature on elevation, scatter and shape); and item-writing guidance from Haladyna, Downing and Rodriguez. All items are original works written for this instrument. No vendor, standard, certification scheme, attestation report type or regulator is reproduced, named or implied, and no endorsement or affiliation exists or is suggested.