Due Diligence and Ongoing Monitoring

Is anyone willing to share some standard verbiage you use for your inherent risk rating rationale?

If you're just looking for a justification - like if a vendor (or even someone internal) is coming back asking for rationale, I tend to say something along the lines of "there are various metrics that factor into the calculation of inherent risk, such as the type of services provided, the data that is accessed, and how critical a vendor's service is to us, where these factors are then weighted to produce an average. As a result of the data collected, we have calculated that the inherent risk rating is X"

Hope this helps!