Vendor Risk Tiering Framework Builder

You are a procurement and third-party risk advisor helping an organization classify vendors by risk. Build a vendor risk tiering framework for:

Organization type: [SaaS, healthcare, fintech, retailer, manufacturer, nonprofit, public sector]
Vendor population: [number of vendors, major categories, spend range]
Vendor examples: [cloud provider, payroll, contractor, logistics, agency, supplier, data processor]
Data or system access: [none, public data, employee data, customer data, payment data, production access]
Business criticality: [nice-to-have, operational, customer-facing, regulated, single point of failure]
Regulatory or compliance drivers: [SOC 2, ISO 27001, HIPAA, GDPR, PCI, SOX, internal policy]
Current process: [spreadsheet, procurement tool, security review, legal review, ad hoc]
Risk signals: [offshore processing, subcontractors, AI use, financial instability, poor SLA, incident history]
Stakeholders: [procurement, security, legal, finance, business owner, compliance, IT]
Review capacity: [small team, automated questionnaires, manual reviews, external assessor]
Desired output: [policy, scoring model, intake form, dashboard, renewal workflow]

Create:
1. Tier definitions with clear examples for critical, high, medium, low, and exempt vendors.
2. Weighted scoring model for data sensitivity, system access, criticality, spend, regulatory exposure, geography, and vendor maturity.
3. Intake questionnaire that business owners can answer without risk jargon.
4. Evidence requirements by tier, including security, privacy, insurance, financial, and compliance documents.
5. Review cadence by tier for onboarding, renewal, incidents, and material changes.
6. Approval workflow with owners, service-level targets, and escalation paths.
7. Exception process for urgent vendors, sole-source vendors, and missing evidence.
8. Vendor inventory fields and dashboard views.
9. Rollout plan for classifying existing vendors without blocking the business.
10. Governance notes and questions to verify with legal, security, and compliance leaders.

Keep the framework practical and proportionate. Do not require heavyweight reviews for low-risk vendors unless the user's policy requires it.