The 47-Hour Problem

A single vendor risk assessment takes an average of 47 hours of manual work. That's an analyst reading contracts, cross-referencing compliance docs, flagging risk clauses, and writing up findings that a decision-maker will skim in five minutes.

Most organizations have dozens of vendors. Some have hundreds. And only 6% of businesses have a clear picture of their supply chain. The rest are making procurement decisions with incomplete information and hoping nothing breaks.

Three structured prompts can compress those 47 hours into minutes. The LLM does the part it's actually good at: extracting structured data from unstructured documents, classifying it against known categories, and formatting it for human review.

The Three-Prompt Chain

The approach mirrors how enterprise tools like Bitsight and Oracle's GenAI risk framework already work. Extract, classify, summarize. The difference is you don't need a $20K/year platform to do it.

Each prompt feeds its output into the next. The chain builds context incrementally so the final output carries forward everything the model found, not just what it remembers from a single massive prompt.

Prompt 1: Document Extraction

This is the foundation. A bad extraction means everything downstream is wrong. The goal is to pull every risk-relevant data point from a vendor document and structure it consistently.

The Prompt:

You are a procurement analyst extracting risk-relevant information from a vendor document. Read the following document carefully and extract ALL of the following fields. If a field is not present or cannot be determined, mark it as "NOT FOUND" -- do not guess or infer.

Document:
[Paste the full text of the contract, SOC 2 report, or compliance document here]

Extract into this exact structure:

VENDOR OVERVIEW:
- Company name:
- Document type:
- Document date:
- Coverage period:

FINANCIAL INDICATORS:
- Payment terms:
- Liability caps:
- Insurance requirements:
- Termination penalties:
- Price escalation clauses:

OPERATIONAL INDICATORS:
- Service-level commitments:
- Uptime guarantees:
- Incident response timelines:
- Subcontractor/subprocessor disclosures:
- Business continuity provisions:
- Data center locations:

COMPLIANCE INDICATORS:
- Certifications claimed:
- Regulatory frameworks referenced:
- Audit findings or exceptions noted:
- Data handling/privacy provisions:
- Breach notification timelines:
- Right to audit clauses:

REPUTATIONAL INDICATORS:
- Indemnification language:
- Limitation of liability scope:
- Force majeure breadth:
- Exclusivity or non-compete terms:

For each extracted item, quote the relevant contract language in brackets after your answer.

Why This Works: The explicit "NOT FOUND" instruction prevents the model from filling gaps with plausible-sounding fabrications. Requiring quoted source language creates a verifiable chain of evidence. The structured categories force consistent extraction across different document types, so you can compare vendors side by side.

Expected Output:

VENDOR OVERVIEW: - Company name: Acme Cloud Services Inc. - Document type: Master Service Agreement - Document date: 2025-11-15 - Coverage period: 36 months from execution

FINANCIAL INDICATORS: - Payment terms: Net 30 ["Payment shall be due within thirty (30) days of invoice date"] - Liability caps: 12 months of fees paid ["aggregate liability shall not exceed the total fees paid in the twelve (12) months preceding the claim"] - Insurance requirements: NOT FOUND - Termination penalties: 60% of remaining contract value ["early termination fee equal to sixty percent (60%) of the fees remaining"] - Price escalation clauses: Annual CPI adjustment, capped at 5% ["fees may be adjusted annually based on CPI, not to exceed five percent (5%)"]

[continues for all categories...]

Prompt 2: Risk Classification

Now you take that structured extraction and score it. This is where the model applies judgment, but within guardrails you control.

The Prompt:

You are a risk analyst classifying vendor risk findings. Below is a structured extraction from a vendor document. Classify each finding into one of four risk domains and assign a severity rating.

Risk Domains:
- FINANCIAL: Cash flow exposure, liability gaps, cost unpredictability
- OPERATIONAL: Service reliability, dependency risks, capacity constraints
- COMPLIANCE: Regulatory gaps, audit deficiencies, data handling violations
- REPUTATIONAL: Brand exposure, contractual imbalances, public liability

Severity Scale:
- CRITICAL: Immediate action required. Contract should not proceed without remediation.
- HIGH: Significant concern. Requires negotiation or mitigation plan before signing.
- MEDIUM: Notable but manageable. Flag for periodic review.
- LOW: Minor or standard. No action needed.

For each finding, output:
1. Finding (one sentence)
2. Risk domain
3. Severity
4. Reasoning (one sentence explaining WHY this severity)
5. Confidence (HIGH/MEDIUM/LOW -- how certain are you about this classification?)

Extraction data:
[Paste the output from Prompt 1 here]

Rules:
- If the extraction says "NOT FOUND" for a field that should exist in this document type, classify the ABSENCE as a finding.
- Do not invent findings not supported by the extraction.
- Group findings by risk domain in your output.

Why This Works: The confidence score is what makes this work. It forces the model to flag its own uncertainty rather than presenting every classification with equal authority. The rule about "NOT FOUND" fields catches omission risk, which is often the biggest red flag in vendor contracts. A SOC 2 report missing breach notification timelines is itself a finding.

Expected Output:

FINANCIAL

Finding: Early termination penalty of 60% of remaining contract value creates significant exit cost. Severity: HIGH Reasoning: A 36-month contract with 60% early termination penalties locks the organization into a relationship where switching costs may exceed the cost of tolerating poor service. Confidence: HIGH

Finding: No insurance requirements specified in the agreement. Severity: MEDIUM Reasoning: Absence of insurance requirements means no guaranteed financial backstop if the vendor causes a data breach or service failure. Standard for smaller vendors but unusual for enterprise contracts. Confidence: MEDIUM

COMPLIANCE

Finding: Breach notification timeline not specified. Severity: CRITICAL Reasoning: Without a defined notification window, the vendor has no contractual obligation to notify within the 72-hour window required by most state breach notification laws and GDPR. Confidence: HIGH

[continues for all domains...]

Prompt 3: Executive Summary

Decision-makers don't read risk matrices. They read summaries with clear recommendations. This prompt compresses the classified findings into something a VP can act on in two minutes.

The Prompt:

You are writing an executive risk summary for a procurement decision-maker. Below are classified risk findings from a vendor assessment. Write a summary that enables a go/no-go decision.

Structure your output exactly as follows:

EXECUTIVE RISK SUMMARY
Vendor: [name]
Assessment Date: [today's date]
Overall Risk Rating: [CRITICAL / HIGH / MODERATE / LOW]
Recommendation: [PROCEED / PROCEED WITH CONDITIONS / DELAY / DO NOT PROCEED]

TOP FINDINGS (maximum 5, ranked by severity):
For each: one-sentence finding, severity, and one-sentence recommended action.

CONDITIONS FOR PROCEEDING (if applicable):
Specific contractual changes or mitigations required before signing.

CONFIDENCE STATEMENT:
State which findings you are most and least confident about, and what additional documents would increase confidence.

Classified findings:
[Paste the output from Prompt 2 here]

Rules:
- The overall risk rating should reflect the HIGHEST severity finding, not an average.
- If any finding is CRITICAL, the recommendation cannot be PROCEED.
- Keep the entire summary under 400 words.
- Write for a reader who has not seen the source documents.

Why This Works: The hard constraint that CRITICAL findings block a PROCEED recommendation prevents the model from softening bad news. The confidence statement at the end is your built-in honesty check. It tells the reader exactly where the assessment is strong and where it needs more data.

Expected Output:

EXECUTIVE RISK SUMMARY Vendor: Acme Cloud Services Inc. Assessment Date: 2026-04-24 Overall Risk Rating: CRITICAL Recommendation: PROCEED WITH CONDITIONS

TOP FINDINGS: 1. No breach notification timeline specified (CRITICAL). Action: Require contractual amendment adding 48-hour notification clause before execution. 2. 60% early termination penalty on 36-month term (HIGH). Action: Negotiate reduction to 25% or add performance-based exit triggers. 3. Insurance requirements absent (MEDIUM). Action: Request certificate of insurance with minimum $5M cyber liability coverage.

CONDITIONS FOR PROCEEDING: - Add breach notification clause (48-hour maximum, written notice) - Reduce termination penalty or add performance-triggered exit at no cost - Obtain proof of cyber liability insurance

CONFIDENCE STATEMENT: Financial and compliance findings are high-confidence, drawn directly from contract language. Operational assessment confidence is low because this MSA does not include the service-level addendum referenced in Section 12.3. Request that document for a complete operational risk picture.

The Hallucination Problem (And Why It's Overstated)

LLMs hallucinate roughly 30% of the time when generating legal citations. Over 600 documented cases have implicated 128 lawyers who submitted AI-fabricated case law to courts. In federal procurement alone, 19 of 20 AI misuse cases in 2025 were filed by people without the legal expertise to catch the errors.

This is real, and it matters. But the three-prompt chain handles it differently than "paste the contract and ask what's risky."

The extraction prompt demands quoted source language. If the model fabricates a clause, you can verify it against the source document in seconds. The classification prompt includes confidence scores, so LOW-confidence findings get flagged for human review instead of being treated as fact. The summary prompt explicitly states what's missing.

Compare this to manual review, where an overworked analyst might focus on financial risk and miss compliance gaps entirely. At least prompted chains make their blind spots visible. A manual review hides them.

When to Use This (And When Not To)

Run this chain on contracts, SOC 2 reports, vendor questionnaire responses, and compliance certifications. It works best on documents with structured language where the model can quote specific clauses.

Don't use it as your only assessment method for vendors handling sensitive data, regulated workloads, or critical infrastructure. The chain is a first pass that surfaces issues faster than any human can read. The human still makes the call.

For agencies and MSPs managing client vendor relationships, this stretches your risk assessment capacity without adding headcount. Run the chain, review the output, deliver a branded assessment. Your clients get faster answers and you spend your time on judgment calls instead of document reading.

Make It Yours

The prompts above work as-is, but they get better when you customize the risk domains and severity criteria for your industry. A healthcare organization should weight HIPAA compliance findings differently than a fintech company weights PCI-DSS gaps. Adjust the classification prompt's domain definitions and severity reasoning to match your regulatory environment.

If your team wants to build prompt chains like this for your specific vendor risk workflow, connect with Kief Studio on Discord or schedule a session. We run hands-on training on exactly this kind of applied prompt engineering.

risk-assessment

Prompting for Supply Chain Risk: Extract Red Flags From Vendor Documents Faster Than Any Analyst