{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Vendor Risk Assessment","description":"Periodic risk assessment of an existing supplier across financial, operational, data-protection, cybersecurity, ESG, geographic, regulatory and concentration dimensions, with mitigations, monitoring cadence and review date. Aligned with ISO 31000:2018 (risk management — guidelines), ISO 9001:2015 clause 8.4.1 (evaluation and re-evaluation of external providers), Directive (EU) 2024/1760 (CSDDD) for human-rights and environmental risk and EBA / EIOPA outsourcing guidelines for the financial-services dimension.","type":"object","additionalProperties":false,"required":["supplier","assessment_date","assessor","risk_dimensions","overall_rating","mitigations","monitoring_cadence","next_review_date","signatory"],"$defs":{"supplier":{"type":"object","additionalProperties":false,"required":["name"],"properties":{"name":{"type":"string"},"registration":{"type":"string"},"country_code":{"type":"string","pattern":"^[A-Z]{2}$"}}},"assessor":{"type":"object","additionalProperties":false,"required":["name","role"],"properties":{"name":{"type":"string"},"role":{"type":"string"}}},"risk_dimension":{"type":"object","additionalProperties":false,"required":["dimension","findings","likelihood","impact"],"properties":{"dimension":{"type":"string","enum":["financial","operational","data_protection","cybersecurity","esg","geographic","regulatory","concentration"]},"findings":{"type":"string"},"likelihood":{"type":"string","enum":["low","medium","high"]},"impact":{"type":"string","enum":["low","medium","high"]}}},"mitigation":{"type":"object","additionalProperties":false,"required":["dimension","action","owner","due_date"],"properties":{"dimension":{"type":"string","enum":["financial","operational","data_protection","cybersecurity","esg","geographic","regulatory","concentration"]},"action":{"type":"string"},"owner":{"type":"string"},"due_date":{"type":"string","format":"date"}}},"signatory":{"type":"object","additionalProperties":false,"required":["name","role","date"],"properties":{"name":{"type":"string"},"role":{"type":"string"},"date":{"type":"string","format":"date"}}}},"properties":{"supplier":{"$ref":"#/$defs/supplier"},"assessment_date":{"type":"string","format":"date"},"assessor":{"$ref":"#/$defs/assessor"},"risk_dimensions":{"type":"array","minItems":1,"items":{"$ref":"#/$defs/risk_dimension"}},"overall_rating":{"type":"string","enum":["low","medium","high"]},"mitigations":{"type":"array","items":{"$ref":"#/$defs/mitigation"}},"monitoring_cadence":{"type":"string"},"next_review_date":{"type":"string","format":"date"},"signatory":{"$ref":"#/$defs/signatory"}}}