The AVRF questionnaire, scoring sheet and the Pellbrook example.

A.1 Vendor criticality

Under AVRF, vendor criticality is set by three things together (Chapter 9).

A.2 Capability class

Reproduced from the deposited specification, Section 2.2. The book's rule follows it: where any doubt exists, classify in the most demanding class, and issue every question in every applicable section; add questions if you must, but remove none (Chapter 9).

"A capability MUST be classified C1 where any doubt exists." (Section 2.2)

A.3 The response record

A response carries all of the following (the deposited specification, Section 5).

Per question, the response records the answer, whether the stated evidence was supplied, and where the evidence is held (Section 5); those are the response columns in Part B.

Attribution. This part reproduces Section 4 of The AI Vendor Due-Diligence Questionnaire: AVRF Instrument for Third-Party AI Systems, Models and APIs, Questionnaire Specification, Version 1.0, by Nabeel Khan, Zenodo, https://doi.org/10.5281/zenodo.22170146, licensed under the Creative Commons Attribution 4.0 International license (CC BY 4.0), https://creativecommons.org/licenses/by/4.0/. The question identifiers, questions, answer formats and evidence expectations are reproduced without change and in the deposit's own spelling. The response columns to the right of them have been added, following the deposit's Sections 3.4 and 5. The license grants no rights in the marks. The concept DOI always resolves to the latest version; this reproduction is of Version 1.0.

Four outcomes, and one rule. Four outcomes are permitted for any question: an answer, an assertion, a decline with a stated reason, or not applicable with a stated reason. A decline is never silently converted into a blank, because "A pattern of declines is itself a finding, and it is invisible if declines are erased." The instrument's central discipline is one line of bookkeeping: "An answer supplied without its stated evidence MUST be recorded as an assertion, and MUST NOT be recorded as a finding." And "A statement by the vendor is not evidence of itself." (Chapter 9, quoting the deposit)

Response columns. Outcome: answered, asserted, declined or not-applicable. Evidence supplied: yes or no. Reason: required for declined and not-applicable. Value: the scoring value of Part C (Satisfied, Asserted, Open, or excluded where not applicable).

Section A. Provenance and identity (8 questions)

Section B. Training data (9 questions)

Section C. Evaluation and performance (9 questions)

Section D. Incident history (8 questions)

Section E. Subprocessors and supply chain (7 questions)

The deposit states that Section E applies to class C1.

Section F. Model change and notification (8 questions)

Section G. Exit and portability (7 questions)

Eight in A, nine in B, nine in C, eight in D, seven in E, eight in F, seven in G. Fifty-six questions. The count is stated so that a truncated copy of the instrument is detectable (the deposit, Section 4.8).

The scoring is offered for the institution to adapt: "A score expresses a risk appetite." One fixed scheme would assert one appetite for every institution using it, and no score computed under it may be represented as a finding of the questionnaire (Chapter 9, quoting the deposit, which marks its scoring appendix informative).

C.1 Three values per applicable question

A not-applicable question is excluded from the denominator rather than counted as satisfied (the deposit, Appendix A.1).

C.2 Counts by section

C.3 Two ratios

The two are kept apart because a vendor that answered everything and evidenced little is a different vendor from one that answered less and evidenced what it answered (Chapter 9).

Before any questionnaire goes out, answer three questions from one vendor contract, one API response from last week and the institution's own records (Chapter 9).

A no to either of the first two is a contract term still to be written. A no to the third means that when the vendor declines, the institution has nothing of its own to validate on.

D.1 The minimum record for an institution that only buys vendor APIs

The discipline's minimum, per call or per decision, is five fields (Chapter 9). Chapter 13's field table, under "Evidence: the record the build emits", is the full version.

A reference holds only while the vendor keeps what it points to. The record runs on the decision's clock: the institution keeps its own copy of any input it may be asked about later, or the reference is not enough. That copy is customer data, whose storage and disposal fall within E-21's definition of data risk, so its retention and access are set with the owners of the privacy obligations (Chapter 9).

A score does not decide. A named person decides, at a gate, and the three decisions available are the gate's: accept, reject, or accept with conditions, which the discipline calls passage, rejection and conditional passage (Chapter 9). The named person is the discipline's choice; E-23 allows the Model Approver to be a unit, an individual or a committee. E-23 permits conditional passage in its own terms: a model "may be approved despite identified weaknesses or limitations provided that compensating mitigants are in place, or the model stakeholder group provides justification for using a model with known limitations or weaknesses".

Conditions as obligations. The conditions are the Open questions turned into obligations, each with an owner and a date (Chapter 9).

Where the provider offers only its standard terms. Where those terms carry no notice before retraining, the substitute moves the notice out of the vendor's promise and into the institution's build (Chapter 9; B-10 foresees the contract that cannot be negotiated). For such a provider the discipline accepts the terms below, with the pin and the replay standing in for the notice clause, as G4's contractual controls in force, and the gate record names the substitution.

"Residual model risk" is a defined term in E-23, approval affirms the residual risk assessment, and "In cases where model risk falls outside the institution's risk appetite, the institution should establish appropriate remediation actions." OSFI's letter puts the same obligation on the institution for third-party models: to ensure that their use is within the institution's risk appetite limit. B-10 asks that the guideline be applied in proportion to the risk and criticality of each arrangement and to the institution's own size and profile.

The residual-risk record for a vendor that falls short carries the following (Chapter 9).

Written in the shape Chapter 6 gave every gate record, the record also declares the following.

Where a validation cannot yet be completed. The letter's exceptions policy is the frame for keeping the model in use, under a limit, while the outcome test runs.

The claim. When a vendor refuses to share its method, the institution validates on the outcomes it already holds.

The test. From one contract and one API response: does the contract require notice before a retrain or rescale, does each response carry a model version, and could your own records yield performance by segment?

The artifact. One vendor scored, with a gate decision.

Worked example: Pellbrook, Cairn from Kelso Analytics

Pellbrook is fictional. The institutions, systems, people and incidents in the book are fictional composites constructed to teach; they are not drawn from any real institution, incident or client engagement. Every value below is a fact the book states about Pellbrook; where the book does not give a value, the field says so. Kelso's response is shaped in Chapter 9 from the case's stated declines and its aggregate figure; no answer of Kelso's is invented here.

The system. Cairn, a vendor-hosted score from Kelso Analytics, called by API on each application, decides which of Pellbrook's broker-submitted mortgage applications go to enhanced verification. A score from 0 to 1,000 that routes an application to enhanced verification is a result under E-23's definition. Pellbrook bought Cairn as a fraud tool; the Chief Operating Officer signed the contract on 15 December 2024 under the vendor policy, and model risk was not consulted; the system was live on 3 February 2025 (Chapter 9).

Internal audit found no approval record, validation evidence or version history on 12 January 2026.

The book gives the shape of the response by section, not question by question. Per-question outcomes and the numeric ratios are not stated in the book.

The two ratios diverge, high on response and low on evidence, with the questions on silent model change and reproducibility in the Open and Asserted columns (Chapter 9). The assurance report is evidence of whatever the report examined, and no more.

The minimum record, for Cairn.

Pellbrook can compute the performance by segment that Kelso declined to supply, from the share of each segment's applications Cairn routed to enhanced verification and the misrepresentation its analysts found in those files. Misrepresentation in an application Cairn did not route is never observed, so the outcome test carries a control: a random sample of applications below the threshold sent to verification as well (Chapter 9).

A vendor record in this shape joins the institution's other evidence instead of sitting in the procurement file where Cairn's contract sat for fourteen months. It is the record Sunil Mehta asked for in January and could not be given, written for the next time he asks (Chapter 9).

nabeelkhan.com/e-23/vendor-assessment. Questions: nabeelkhan.com/contact.