Template placeholder reference

This is the complete list of placeholders you can write in an assessment report template. Field names are matched case-insensitively, and whitespace around the entity, the ::, and the field name is ignored. The same list is in the product: Variables Catalog in the Add new assessment report template dialog shows every placeholder with its exact spelling, including your organization’s enabled custom fields, and copies one when you click it.

Vendor

{{vendor::<field>}} resolves against the vendor that the assessment belongs to.

Placeholder	Value
`{{vendor::name}}`	Vendor name
`{{vendor::description}}`	Vendor description
`{{vendor::location}}`	Vendor headquarters location
`{{vendor::use cases}}`	The vendor’s use case text
`{{vendor::relationship owners}}`	Comma-separated display names of the relationship owners
`{{vendor::risk analysts}}`	Comma-separated display names of the risk analysts
`{{vendor::watchers}}`	Comma-separated display names of the watchers
`{{vendor::dri}}`	The vendor service requestor recorded on the vendor
`{{vendor::<custom field name>}}`	Any enabled vendor custom field, addressed by its name

Assessment

{{assessment::<field>}} resolves against the assessment being exported. Dates are formatted YYYY-MM-DD in the timezone supplied at export time.

Placeholder	Value
`{{assessment::residual risk}}`	Residual risk level name. Falls back to `Low` when no level is set
`{{assessment::inherent risk}}`	Inherent risk level name
`{{assessment::assignee}}`	Display name of the assignee
`{{assessment::approval option}}`	Label of the selected approval option
`{{assessment::completed at}}`	Date the assessment was completed
`{{assessment::next vendor assessment}}`	The vendor’s next assessment date, or `Never` when reassessment is disabled
`{{assessment::recommendation}}`	`Status: recommendation text`, using whichever parts are present
`{{assessment::assessment score}}`	Average score, else percent score with a `%` suffix, else summed score, to one decimal place
`{{assessment::vendor documents}}`	Bulleted list of the non-archived supporting document names
`{{assessment::summary}}`	The assessment summary body, flattened to plain text. Markdown headings become uppercase lines and list markers become bullets
`{{assessment::open issues}}`	Bulleted list of open issues as `#<number> <title>`
`{{assessment::<custom field name>}}`	Any enabled assessment custom field, addressed by its name

Services

{{services::<field>}} covers all services in scope on the assessment, flattened into a single value. When the assessment has one service, the value is the bare field value. When it has more than one, the value becomes a bulleted block of • Service name - value, and services with no value for that field are dropped. When the assessment has no services, every services placeholder is empty.

Placeholder	Value
`{{services::name}}`	Comma-separated list of service names. This one is always comma-separated, never bulleted
`{{services::description}}`	Service descriptions
`{{services::inherent risk}}`	Inherent risk level name per service
`{{services::relationship owners}}`	Relationship owners per service
`{{services::watchers}}`	Watchers per service
`{{services::next assessment date}}`	Next assessment date per service, or `Never`
`{{services::<custom field name>}}`	Any enabled service custom field, addressed by its name

Reviews

{{reviews::<field>}} covers the whole-assessment reviews on the assessment. Domain-scoped reviews from the risk profile are excluded, matching the other exports. Formatting follows the same rule as services: a single review renders bare, several reviews render as a bulleted block keyed by a row label. The row label is the review name, falling back to the reviewer, falling back to Review 1, Review 2, and so on.

Placeholder	Value
`{{reviews::summary}}`	One self-contained line per review, `<label> - <outcome>: <notes>`. Outcome falls back to `Pending`
`{{reviews::reviewer}}`	Reviewer per review
`{{reviews::status}}`	Review status label
`{{reviews::outcome}}`	Review outcome label, or `Pending` while undecided
`{{reviews::description}}`	Review description
`{{reviews::notes}}`	Reviewer notes
`{{reviews::decided}}`	Date the review reached its outcome. An undecided review has no date
`{{reviews::last updated}}`	Date the review was last updated

Use {{reviews::summary}} when there is more than one reviewer. The individual field placeholders each produce their own bulleted list, so reading a reviewer’s outcome next to their notes means cross-referencing two lists. summary keeps each reviewer’s label, outcome, and notes on one line.

Vendor Intelligence

{{intelligence::<field>}} resolves against Coverbase’s outside-in research on the vendor — the data behind the Vendor Intelligence tabs — plus any financial statements your organization has submitted for that vendor. These are stored values, so they resolve exactly, without a model call. Prefer them over {{agent::...}} for any figure that is a fact rather than a judgement: a placeholder cannot get a market capitalization wrong. Every {{intelligence::...}} placeholder resolves to something. A field with no value for this vendor (a private company has no market capitalization) renders Not available rather than staying in the document as placeholder text. So does a field from a Vendor Intelligence surface your organization is not entitled to.

Company and market

Placeholder	Value
`{{intelligence::industry}}`	Industry on the vendor’s company profile
`{{intelligence::headquarters}}`	Headquarters location
`{{intelligence::founded}}`	Founding year
`{{intelligence::employees}}`	Employee count
`{{intelligence::revenue}}`	Most recent fiscal year revenue
`{{intelligence::public or private}}`	Whether the company is publicly traded
`{{intelligence::market capitalization}}`	Market capitalization, abbreviated (e.g. `$12.2B`)
`{{intelligence::ticker}}`	Stock ticker symbol
`{{intelligence::exchange}}`	Exchange the company is listed on
`{{intelligence::total funding}}`	Total disclosed funding raised

Financial health

Placeholder	Value
`{{intelligence::financial health score}}`	Coverbase Financial Health Score out of 100
`{{intelligence::financial health band}}`	Risk band the score falls in
`{{intelligence::financial health confidence}}`	Confidence tier behind the score (`A`, `B` or `C`)
`{{intelligence::financial health as of}}`	Date the score was computed as of

Security posture

Placeholder	Value
`{{intelligence::security rating}}`	Grade and score together, e.g. `B (78/100)`
`{{intelligence::security grade}}`	Letter grade alone
`{{intelligence::security score}}`	Score out of 100
`{{intelligence::security next steps}}`	Recommended actions from the scan, most urgent first, joined with semicolons
`{{intelligence::security change since last scan}}`	What moved since the previous scan in one line, e.g. `since 2026-08-12: score -6, 2 new findings, 1 new CVE`
`{{intelligence::trust center}}`	URL of the vendor’s trust center

Corporate registration

Placeholder	Value
`{{intelligence::legal name}}`	Official registered name from the corporate registry
`{{intelligence::registration status}}`	Registration standing
`{{intelligence::jurisdiction}}`	Jurisdiction the company is registered in
`{{intelligence::incorporation date}}`	Date of incorporation
`{{intelligence::lei}}`	Legal Entity Identifier
`{{intelligence::duns}}`	Dun & Bradstreet DUNS number
`{{intelligence::company number}}`	Local business register company number
`{{intelligence::cik}}`	SEC EDGAR Central Index Key

People, reputation and screening

Placeholder	Value
`{{intelligence::leadership}}`	Confirmed executives and board members, comma-separated
`{{intelligence::adverse media}}`	`None found`, `Not searched`, or a count. Never reports an unsearched vendor as clear
`{{intelligence::bbb rating}}`	Better Business Bureau rating
`{{intelligence::trustpilot rating}}`	Trustpilot rating
`{{intelligence::screening status}}`	Sanctions and adverse-media screening result for the vendor: `Not enrolled`, `Screened, no matches`, or the number of matches and how many await review

Submitted financial statements

These resolve only when your organization has uploaded financial statements for the vendor. The metric blocks each render one line per metric, with both fiscal years and the change between them.

Placeholder	Value
`{{intelligence::financial statements}}`	Classification of the submitted statements, e.g. `Audited - Unqualified Opinion`
`{{intelligence::financial risk rating}}`	Credit policy risk rating derived from the statements
`{{intelligence::statement legal entity}}`	Legal name of the entity that issued the statements
`{{intelligence::auditor}}`	Audit firm that signed the opinion
`{{intelligence::period covered}}`	Fiscal periods the statements cover
`{{intelligence::net worth}}`	Net worth for the most recent submitted fiscal year
`{{intelligence::ebitda}}`	EBITDA for the most recent submitted fiscal year
`{{intelligence::free cash flow}}`	Free cash flow for the most recent submitted fiscal year
`{{intelligence::policy metrics}}`	The four credit policy metrics with their ratings and figures
`{{intelligence::balance sheet metrics}}`	Working capital, current, quick and cash ratios, debt, debt to equity, net worth, asset turnover, return on assets, return on equity
`{{intelligence::income statement metrics}}`	Revenue, EBIT, EBITDA, debt to EBITDA, margins, net income, EPS, inventory and AR turnover
`{{intelligence::cash flow metrics}}`	Free cash flow and change in cash
`{{intelligence::leverage ratios}}`	Debt to capitalization, equity multiplier, degree of financial leverage

A figure the statements do not report renders as Not reported, never as 0. A zero would read as a measured result, which is a different claim about the vendor.

Findings

{{findings::<set>::<column>}} only works inside a table row. The row is cloned once per finding in the set. See repeating findings tables for how to lay the table out, and one table per risk domain to split findings by risk domain. Sets:

Set	Contents
`new`	Findings raised by this assessment
`pre_existing`	Still-open findings on the same vendor that did not come from this assessment

Columns, usable with either set:

Column	Value
`id`, `public id`, `public idx`	The finding’s public reference number
`title`	Finding title
`description`	Finding description, including recommendations
`status`	Finding status
`due date`	Due date, `YYYY-MM-DD` in the export timezone
`risk level`	Risk level from the risk matrix (urgency by severity)
`risk severity`	Criticality tier derived from the control’s maximum score
`severity`	Severity set by the reviewer
`urgency`	Urgency set by the reviewer
`assignee`, `assigned to`	Display name of the assignee
`created by`	Display name of the creator
`control`, `control expectation`	The control expectation the finding was raised against
`risk domain`, `risk domains`	Risk domain of the control the finding was raised against. Comma-separated when the finding spans controls in several domains
`score`	Score level name
`resolution timeline`	Days allowed to resolve a finding at this risk level, from your findings settings, as a number

Rows where a column has no value render that cell empty. Each set is capped at 100 rows.

Scoping a table to one risk domain

{{findings::<set>::<risk domain>::<column>}} narrows a table to the findings whose controls belong to one risk domain, so a report can carry a separate table per domain:

{{findings::new::Information Security::title}}
{{findings::new::Privacy::title}}
{{findings::pre_existing::BRM::title}}

The domain is the name as configured in Configuration → Risk domains, matched ignoring case and surrounding spaces. It resolves per finding through the control the finding was raised against: the control section’s risk domain when it sets one, otherwise the control set’s. A domain with no findings renders “No new findings for Privacy”; a domain your org does not have is reported as an unknown placeholder.

Agent

{{agent::<your prompt>}} generates prose from the assessment. The whole text after :: is the prompt. The agent reads the assessment, its findings, evals, reviews, services and commitments, and questionnaire responses, and the headline of every Vendor Intelligence section — company profile, financial health, security posture, corporate registration, people, reputation, compliance and legal, products, and sanctions screening. It can pull any of those sections in full when a prompt needs the evidence behind a headline. Use a placeholder rather than the agent for anything that is a stored value. The agent is for judgement: a conclusion, an overview, a paragraph weighing several facts together.

{{agent::Write a short executive summary of this assessment for a board audience.}}

Output is rendered as Word content, honoring **bold**, *italic*, ***bold italic***, ==highlight==, and bulleted and numbered lists. Headings and markdown tables are not rendered. See AI-written sections for the full behavior, including timeout and failure markers.

Custom field formatting

Custom fields render according to their configured type.

Field type	Renders as
Text	The stored text
Number	Comma-grouped, with up to two decimal places and none on whole numbers, so `1000` renders as `1,000`. Fields configured as currency render as USD, so `1234.56` becomes `$1,234.56`
Date	`YYYY-MM-DD` in the export timezone
Boolean	The literal words `True` and `False`
User	Comma-separated display names of the selected users
Select	Every option listed, with `✅` on the selected one and `◻️` on the rest
Multi-select	Every option listed, with `✅` on each selected one and `◻️` on the rest

Select and multi-select fields with more than 10 options collapse to a plain comma-separated list of only the selected values. A marked list of 70 country options is unreadable in a report, so Coverbase drops the unselected ones automatically.

Quick lookup

I need the vendor's name and description

{{vendor::name}} and {{vendor::description}}.

I need the risk rating that came out of this assessment

{{assessment::residual risk}} for the outcome, {{assessment::inherent risk}} for the starting point, {{assessment::assessment score}} for the numeric score.

I need a table of the issues we raised

A two-row table with {{findings::new::id}}, {{findings::new::title}}, {{findings::new::risk level}}, and {{findings::new::due date}} in the body row.

I need a separate issues table for each risk domain

One table per domain, each using {{findings::new::<risk domain>::<column>}}, for example {{findings::new::Privacy::title}}. Or keep one table and add a {{findings::new::risk domain}} cell to label each row.

I need the approver and their decision

{{reviews::summary}} for everything on one line per reviewer, or {{assessment::approval option}} for the approval decision recorded on the assessment itself.

I need the vendor's financial or security ratings

{{intelligence::financial health score}}, {{intelligence::financial health band}} and {{intelligence::security rating}}. For a credit memo built on submitted statements, {{intelligence::financial risk rating}} and the metric blocks.

I need the vendor's registered legal name

{{intelligence::legal name}}, with {{intelligence::jurisdiction}} and {{intelligence::incorporation date}} beside it.

I need a narrative paragraph that is not a field

{{agent::...}} with a specific prompt. Say who the audience is and how long the answer should be.

Start here

Workspace setup

Vendors

Assessments

Findings and obligations

Vendor intelligence

Monitoring

Risk

Contracts

E-signature

Documents

Workflows and automation

Dashboards and reporting

Sourcing

Internal controls

Template placeholder reference

Vendor

Assessment

Services

Reviews

Vendor Intelligence

Company and market

Financial health

Security posture

Corporate registration

People, reputation and screening

Submitted financial statements

Findings

Scoping a table to one risk domain

Agent

Custom field formatting

Quick lookup

​Vendor

​Assessment

​Services

​Reviews

​Vendor Intelligence

​Company and market

​Financial health

​Security posture

​Corporate registration

​People, reputation and screening

​Submitted financial statements

​Findings

​Scoping a table to one risk domain

​Agent

​Custom field formatting

​Quick lookup

Vendor

Assessment

Services

Reviews

Vendor Intelligence

Company and market

Financial health

Security posture

Corporate registration

People, reputation and screening

Submitted financial statements

Findings

Scoping a table to one risk domain

Agent

Custom field formatting

Quick lookup