Third Party Risk Management

Manage SAE templates for TPRM from the Unified Content Management page in the Vendor Management Workspace. You can view available templates, select template versions, activate or update templates for use in Third-party Risk Management assessments, and update templates when newer versions are released.

Configure the related lists that appear in the vertical navigation layout on record pages in the Vendor Management Workspace.

If you have the admin role, you can configure the ServiceNow Otto for Third-party Risk Management (TPRM) application so that agents can use the generative AI capabilities in Vendor Management Workspace.

Generate a summary of a TPRM issue to support efficient triaging, remediation, and reporting using the TPRM issue summarization skill. Summarized issues help risk assessors and analysts quickly review issue content and take informed action.

Use the external assessment template form to capture all the information that you need to create an external assessment template. As a third-party risk manager, you can create an assessment template.

Use the internal assessment form to capture all the information that you need to create an internal assessment. As a third-party risk assessor, you can create an assessment template.

Use the Questionnaire Template Designer to create and edit questionnaire or document request templates that you can use as the basis for other templates.

You can reuse questionnaire templates and document-request templates to speed up the creation of new questionnaires and document requests.

Use generative AI to identify and recommend potential Third-party Risk Management issues based on assessment responses. The TPRM issue recommendation skill presents recommended issues with rationalized summaries for reviewer confirmation.

Create a TPRM SAE questionnaire or document request template that supports SAE for risk identification. After integrating SAE, new users must create SAE templates, and existing users can create additional templates after migrating their existing ones.

When defining an assessment template, the third-party risk manager provides scheduling information for the third-party risk assessment.

Configure a third-party risk assessment to recur on a schedule to regularly update risk results for a third party or an engagement.

You can change a dashboard name, add a description, certify it, configure visibility, and specify the requester, the owner, the owner group.

You can edit dashboard and dashboard tab information in the in-line editor. If the dashboard has been shared, any changes you make are applied globally.

Before you try to import the questionnaire data from a Microsoft Excel spreadsheet into Third-party Risk Management tables, you must verify that its format meets particular guidelines.

With the ServiceNow Otto for Third-party Risk Management (TPRM) application, you can use skills to automate the collection of TPRM risk data.

Export received or returned questionnaires to Microsoft Excel spreadsheets. This option enables you to use the spreadsheet environment to review questions and answers.

If you maintain questionnaires using Microsoft Excel spreadsheets, you can save time and effort by importing your spreadsheet data directly into TPRM tables. You can then create questionnaires automatically from templates.

Extend the capabilities of TPRM.

The issue recommendation skill in ServiceNow Otto for Third-party Risk Management (TPRM) uses generative AI to suggest potential issues based on historical assessment data, helping assessors and reviewers identify relevant risks more efficiently while retaining control over which issues are created.

The issue summarization skill in ServiceNow Otto for Third-party Risk Management (TPRM) uses generative AI to create concise summaries of vendor-related issues, helping assessors quickly review risk details, improve consistency, and accelerate remediation.

Accept recommendations to create issues based on historical assessment data, or dismiss recommendations that aren’t relevant. Accepting or dismissing issue recommendations helps reviewers efficiently act on AI‑predicted findings while retaining control over which issues are created.

The GRC: Policy and Compliance Management integration updates the compliance status of controls and control objectives based on the questionnaire responses from a third party or engagement. Compliance managers [sn_compliance.manager] can associate controls and control objectives with specific questions, third parties, and engagements used in Third-party Risk Management.

Verify that TPRM still works after you make configuration changes such as applying an upgrade or developing an application. Copy and customize the quick-start tests to pass when using your instance-specific data.

Integrating Risk Management with Third-party Risk Management lets you model enterprise risks and use third‑party assessments to dynamically update risk posture and scores for third parties and engagements. Optional TPRM rules can trigger assessments or remediation work when risks change.

Install the required applications and verify prerequisites to enable SBOM collection in Third-party Risk Management (TPRM).

Track processing status and review the outcome of a SBOM submission from an engagement, including successful upload, failed upload, and decline.

Update the header and footer images used in email notifications by modifying image records for Third-party Risk Management.

Configure email communication with third-party contacts to enable email notification of assessments and issues.

You can use the Maximum normalization input setting to use normalized values to calculate assessment scores for questions (metrics).

Get a quick overview of the important information that is related to the ServiceNow Otto for Third-party Risk Management (TPRM) application.

The ServiceNow GRC: Third-party Risk Management (TPRM) application enables you to proactively identify, assess, and mitigate risks that are associated with your third-party relationships. TPRM provides a centralized process for managing your portfolio of third parties, assessing and scoring risk, and performing remediation.

Email notifications are sent automatically for TPRM events across due diligence requests, third-party risk assessments, issues and tasks, and third-party portal activity.

If you’re using both Policy and Compliance Management and Third-party Risk Management, you can associate control objectives and controls with questions. Controls can be marked as compliant or non-compliant based on the response to the question.

If you’re using both Policy and Compliance Management and Third-party Risk Management, you can associate controls with third parties and engagements. Controls can be marked as compliant or non-compliant.

Add Digital resilience information to third-party engagements by creating ICT third-party service provider records in Digital resilience third-party registers using Third-party Risk Management. Add details such as name of the service provider, its identification code, type of ICT services, currency, and so on. This enhances the digital resilience information of its associated third-party engagement for compliance with DORA regulation.

Use the third-party portal to upload and manage documents for assessments, engagements, issues, and tasks in Third-Party Risk Management (TPRM).

If you’re using both Risk Management and Third-party Risk Management, you can associate risks and risk statements with third parties and engagements. These associations influence risk posture and scoring.

Set up the approval levels and rules for due diligence requests in the Third-party Risk Management application to use while approving or rejecting requests after reviewing questionnaire responses and due diligence process results.

The approval rule form captures all the information needed to create an approval rule. An admin or third-party risk admin can create an approval rule.

Migrate an existing questionnaire or document request template to a TPRM SAE questionnaire template. You must migrate all classic templates to TPRM SAE templates or create new ones before you can use SAE in TPRM.

Use Third-party Risk Management to identify and assess potential risks that are associated with your third-party relationships. The information gathered from internal questionnaires, external questionnaires, and documentation requests helps you to understand the third party's risk profile, determine the appropriate risk mitigation strategies, and determine whether the third party or engagement meets all necessary compliance requirements.

Create records in bulk from the Digital resilience third-party registers using Third-party Risk Management rather than creating one record at a time for single or multiple entities. You can save time and effort by working on multiple records at a time.

Update existing records in bulk from the Digital resilience third-party registers using Third-party Risk Management.

Track changes across document revisions collected during third-party assessments in the Document Management System. Use version comparison to review edits, deletions, and formatting changes between two Word document versions.

Components are the entities for which you can assess risk (for example, subsidiaries or engagements). A component criteria is a group of components that should apply to a particular type of third party or engagement.

Create a connection to fetch and update scores from EcoVadis to help ensure that your risk and theme scores remain current when using Third-party Risk Management.

You can optionally customize the default values of the sn_ecovadis.token_uri and sn_ecovadis.score_uri system properties. These properties manage tokens and access risk scores from EcoVadis when using Third-party Risk Management.

You can activate or upgrade TPRM, by downloading the applications from the ServiceNow Store and then configuring the settings to meet your needs.

Use the control objectives form to capture all the information that you need to associate a control objective with a question using the Third-party Risk Management application.

Use the create new control form to capture all the information that you need to associate a control with a third party or engagement using the Third-party Risk Management application.

Use the third-party risk assessment form to capture all the information that you need to create an assessment using the Third-party Risk Management application. As a third-party risk assessor or manager, you can create an external assessment.

Create an assessment and initiate the third-party risk assessment life cycle using Third-party Risk Management. An external assessment specifies the details for the third party or engagement and defines the plan for completing the assessment.

You can create dashboards with data visualizations, filters, and other elements that you can share with others. You can create elements and add existing elements from the in-line editor.

Use the document management system to version documents in Third-Party Risk Management (TPRM).

Use the Document Management system to create document records in Third-party Risk Management.

Use the create new third-party engagement form to capture all the information that you need to create a third-party engagement record in Digital resilience third-party registers using Third-party Risk Management. As a third-party risk assessor you can create a third-party engagement record.

On the Create New ICT third-party service provider form, fill in the fields.

Create an internal assessment as part of a due diligence request or ongoing risk monitoring using Third-party Risk Management. An internal assessment can affect which questionnaires are later sent to the third party or engagement.

On the Create New Branch form, fill in the fields.

On the Create New Contractual arrangement form, fill in the fields.

On the Create New Contract form, fill in the fields.

On the Create new document form, fill in the fields for the document.

On the Create New Function form, fill in the fields.

On the Create New Company form, fill in the fields for the legal entity.

On the Create New Legal entity form, fill in the fields to set up the digital resilience information.

Use the assessment metric type form to capture all the information that you need to create a questionnaire template using the Third-party Risk Management application. As a third-party risk admin, you can create a questionnaire template.

Convert and aggregate contractual expenses to regulator-required currencies and generate consolidated reports for reporting submission.

Use the Create New TPRM questionnaire template form to capture all the information that you need to create a TPRM SAE questionnaire template using the Smart Assessment template designer. As a third-party risk admin, you can create a questionnaire template.

Use the third-party risk task form to capture the information needed to create a task in the Third-party Risk Management application. As a third-party risk assessor or manager, you can create an internal or external task.

On the Create New Company form, fill in the fields for the third party.

Use the Third-party Risk Management (TPRM) data model to assess, monitor, and mitigate the risks for your risk management program.

The due diligence request form captures all the initial information that you need to start the due diligence process. Any employee within your organization can request due diligence. If you’re selecting an existing third party, a significant portion of the information is automatically filled in.

Request that an engagement be permanently terminated when an engagement ends or you want to switch to a different third party for other reasons. In this case, you typically don't need to conduct additional due diligence. The process does, however, include the normal Inherent Risk Questionnaire (IRQ) process to confirm that the services provided by the engagement will no longer continue.

You can delete a dashboard that is no longer useful. The Analytics Overview invokes the Workflow Studio to remove the dashboard from your instance.

Use the Smart Assessment Response Assist skill to generate draft responses for assessment questionnaires using vendor documents from the Document Management System (DMS) and previously completed assessments.

Turn on AI-assisted questionnaire pre-fill for a smart assessment template category by selecting the Is AI response enabled check box.

Use the Document Management System (DMS) with the Smart Assessment Engine (SAE) to automatically generate draft responses for third‑party risk assessment questionnaires using vendor documents and previously answered assessments.

Learn how the enhanced Document Management system supports third-party collaboration and internal workflows in Third-party Risk Management (TPRM).

Controls who can view, edit, or manage a document using the Document Management system in Third-party Risk Management (TPRM).

Domain separation is supported for TPRM. Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

During report generation, the Register of Information (RoI) converts contract annual expenses to a base currency. It then aggregates totals per eligible third-party provider or engagement. The RoI is a regulatory reporting requirement under the Digital Operational Resilience Act (DORA) and is supported by the Digital Resilience Third-party Information Register application in the Vendor Management Workspace application.

Field descriptions and the full set of closed-set options for the Terminology and definitions list, used to populate the DORA B_99.01 Register of Information export.

Define your organization's internal definitions for the closed-set indicator options used across the Register of Information, so the B_99.01 export includes your terminology rather than empty values.

The Register of Information (RoI) is a regulatory reporting requirement under the Digital Operational Resilience Act (DORA) and is supported by the Digital Resilience Third-party Information Register application in the Vendor Management Workspace.

Use the Digital Resilience Third-party Information Register application in the Vendor Management Workspace to create, update, and track assessments, branches, and legal entities. Maintain registers of contractual arrangements with ICT third-party service providers.

Create an assessment of the Information and Communication Technology (ICT) service in Digital resilience third-party registers using Third-party Risk Management. Add details such as the contractual arrangement reference number, identification code, and type of code for the ICT third-party service provider. You can then enhance its digital resilience information for compliance with DORA regulation.

Create a branch record in Digital resilience third-party registers using Third-party Risk Management. You can then enhance its digital resilience information for compliance with DORA regulation.

Create a contract record in Digital resilience third-party registers using Third-party Risk Management where you add details of the contract such as vendor name, start and end dates, state, substate. You can then enhance its digital resilience information for compliance with DORA regulation.

Create a function record in Digital resilience third-party registers using Third-party Risk Management where you can configure details of the function such as function identifier, license activity, function name, criticality, or importance assessment details. You can then enhance its digital resilience information for compliance with DORA regulation.

Create an Information and Communication Technology (ICT) service supply chain record in Digital resilience third-party registers using Third-party Risk Management. You can then configure details of the supply chain such as the type of the ICT services, Legal Entity Identifier (LEI) of the entity that provides the ICT services.

Create a third-party record in Digital resilience third-party registers using Third-party Risk Management. Add the details of the third-party company such as its name, address, phone number, vendor manager. You can then enhance its digital resilience information for compliance with DORA regulation.

Create a third-party engagement record in Digital resilience third-party registers using Third-party Risk Management. Add details of the third-party engagement such as the name of the third party, its type, annual spend, engagement tier. You can then enhance its digital resilience information for compliance with DORA regulation.

Use the CSV report option in the download page to generate regulator-ready Register of Information (RoI) packages.

In the due diligence process, you typically conduct several types of due diligence to gather relevant information and assess various aspects of the third party. The particular types of due diligence that you conduct vary depending on the nature and criticality of the engagement and the risks involved.

Retrieve current scores and scorecards from EcoVadis on demand or at a set frequency of time using Third-party Risk Management. Customizing settings for the EcoVadis Fetch Score Scheduler can help you get the latest scores when you need them.

You can edit the contents of a dashboard or dashboard tab, including data visualizations and filters. Because dashboards are shared, any changes you make are applied globally.

Manage third-party elements in the Elements grid by adding, editing, and deleting records. You can also link AI models to AI use case elements in the Third-party Risk Management application.

Element collection tasks let internal users add AI use case elements and let third-party or engagement contacts add elements on behalf of the third party in the Third-party Risk Management application.

An engagement risk-scoring rule specifies component criteria that determine which engagements are selected for assessment. For example, a rule could enable assessments for engagements that involve more than $40,000 annual business. Engagement scoring rules apply only to engagements.

The particular third-party engagements that you might have depend on your industry, size, and operational requirements. Each engagement brings its own set of risks and requires appropriate risk management measures (due diligence) to protect your interests.

When an event-driven management rule runs, it auto-generates and sends questionnaires and doc requests to third parties. You can view the current state (running, successful, or recalled) of all runs of rules. Select a record number to view details and to view the set of assessments generated by the rule.

Use the Event-driven management feature to configure rules that auto-generate and send questionnaires and doc requests to engagements and third parties. For engagements and third parties that meet the criteria you define, you specify the schedule and the assessment templates. You can automate all assessment types except onboarding.

When an event-driven management rule runs, it auto-generates and sends questionnaires and doc requests to third parties. You can view the current state (running, successful, or recalled) of all runs of rules. Select a record number to view details and to view the set of assessments generated by the rule.

You can recall third-party risk assessments (questionnaires and document requests) that were sent by an event-driven management rule. The items are removed from the Third-party portal for all third parties or engagements that haven’t yet responded.

Third parties and engagements can use a Microsoft Excel spreadsheet to respond to questionnaires by downloading the template, completing it, and importing the final version into the Third-party portal. This enables respondents to provide information outside the third-party portal.

Use the Create New Excel download/upload request form to capture all the information that you need to create a download/upload request for Digital resilience third-party registers using the Third-party Risk Management application. As a third-party risk manager or third-party risk assessor you can create an Excel download/upload request record.

Create a Microsoft Excel download request to download the records from the Digital resilience third-party registers using Third-party Risk Management for auditing purposes.

The Third-party Risk Management application centralizes and standardizes the processes, source materials, responsible persons, and methods of your third-party risk management program. You can improve your operations by managing your portfolio of third parties and by identifying, tracking, and mitigating the issues that arise with third parties.

The process of collecting assessment data from a third party moves through several states. For example, during the Submitted to third party state, the third party responds to tasks, issues, and works to complete the questionnaires.

Create a fourth-nth party record by using the Third-party Risk Management application. You can create fourth-nth party records manually as an alternative to using a fourth-party registration questionnaire.

Promote a fourth-nth party record to a third party by using the Third-party Risk Management application. If you’re now working with a fourth-nth party at the third-party level, you can keep relevant information current by promoting a fourth-nth party record to a third-party record.

Register fourth-nth parties after collecting responses from a third party by using the fourth-party registration questionnaire in the Third-party Risk Management application. With the fourth-party registration questionnaire, you can create multiple fourth-nth party records at a time.

Create an issue generation rule that will automatically create an issue based on question responses to external assessments. Issues help ensure that your concerns about a third party or engagement are remediated.

Assign users to groups before you implement or use the Third-party Risk Management application. Each group contains users with particular roles. Well-organized user groups simplify and improve process management and help to ensure that users are promptly notified of tasks in their areas of responsibility.

Import existing data (third parties, engagements, assessments, questionnaires, issues, and so on) from other systems (like the Aravo platform, the ProcessUnity platform, and so on). You aren’t charged for importing the data.

The Third-party Risk Management application includes support for risk intelligence provider integrations. These guidelines can help your organization to develop a risk intelligence provider integration for Risk intelligence report (RIR) requests for third parties and due diligence requests.

Integrating EcoVadis into your third-party risk management program can enhance your ability to assess and mitigate risks associated with sustainability and corporate social responsibility (CSR). By leveraging EcoVadis' comprehensive sustainability ratings, you can gain detailed insights into the environmental, ethical, and social practices of your third parties.

Use Unified Content Management (UCM) as a centralized, managed repository of pre-built smart assessment templates for Third-party Risk Management. With UCM installed, TPR managers can browse, preview, and activate templates for assessments, and update templates when newer versions are released.

Create an internal task to assign follow-up work to an internal user, rather than to a third-party contact, as part of your organization's third-party risk processes.

Respond to an Inherent Risk Questionnaire (IRQ) or internal assessment that has been assigned to your queue. Your responses to the questionnaire help determine if the process moves forward and can affect which questionnaires are sent to the third party or engagement.

Create a legal entity record in Digital resilience third-party registers using Third-party Risk Management. You can then configure digital resilience information for the legal entity such as its name, type, country, and hierarchy.

The Level 4 LEI Validation Report (Level4_LEI_Validation_Report.csv) is generated during a Plain-CSV Reporting Package download. It lists the validation result for each Legal Entity Identifier (LEI) code found in the reporting package.

Use the Document Management system to link documents to assessments, engagements, issues, and tasks for traceability in Third-party Risk Management (TPRM).

View your existing third-party contacts and adjust their information and access permissions as needed by using Third-party Risk Management. When you keep the contact details up to date, you can help to avoid your third-party contacts from getting unauthorized access or losing authorized access to the third-party portal.

View managed activities in the usage analytics activities table for tracking and verification purposes in the Third-party Risk Management application.

Learn what changes when you migrate from the Classic Assessment Engine to the Smart Assessment Engine, including feature differences, limitations, and setup requirements. This overview can help you and your team evaluate the impact before enabling the new engine.

You can view the templates that were migrated to Smart Assessment format.

You can monitor and analyze assessment data at various levels in the Third-party Risk Management application using the Third-party insights dashboard and TPRM custom analytics dashboard. These dashboards provide you and your team with tailored insights and deliver relevant information at a glance, improving your decision-making process.

You can identify and manage the third-party risks that depend on the services of the fourth-nth parties by using the Third-party Risk Management application. By monitoring your fourth-nth parties, you can help to ensure that they adhere to the same security and compliance standards as the primary third party.

Monitor third-party elements using scalable scoring models, relationship analysis, and due diligence workflow integration in the Third-party Risk Management application to conduct more informed risk assessments as part of your third-party risk program.

You can monitor the potential risks that are associated with your third-party relationships by using the Third-party Risk Management application. An ongoing monitoring process can help you regularly assess the third party's performance and adherence to the agreed-upon terms.

The TPR manager and TPR admin roles involve a broad variety of responsibilities. After the TPRM base system is set up, you configure additional settings that enable and enhance everyday risk-assessment tasks.

Add a contact from your third-party organization to a specific engagement team so they can access questionnaire requests for that engagement.

The third-party portal uses a role-based access model to control who can view, respond to, and manage questionnaire requests, issues, and tasks. Each of the four contact role types has a defined scope and set of permissions.

Remove a contact's access to the third-party portal when they no longer need it, such as when a team member leaves the organization or changes roles.

Invite a new team member to the third-party portal so they can access questionnaire requests, tasks, and issues for your organization.

Add or remove contributors for a questionnaire request, or transfer questionnaire ownership to another contact, so the right team members can collaborate on and submit the questionnaire.

Each Smart Assessment Engine questionnaire request in the third-party portal has a single questionnaire owner and can include questionnaire contributors. Ownership determines who can submit the completed questionnaire and who can manage team access.

As a third-party contact, respond to assessment questionnaires issued by your assessment team. You can answer questions directly in the portal, use a spreadsheet template, or use a SIG questionnaire format to provide your responses.

Configure property settings for a variety of TPRM operations.

After you add a question to a question bank, you can reuse it in any assessment by dropping it into the assessment. You can create custom questions, add existing questions, or add and customize the sample questions that are included with the base system.

The questionnaire that you use can depend on your industry, geographic area, jurisdiction, or the particular nature of your operations. These questionnaires are provided as part of the base system and are samples that shouldn’t be implemented into your risk management program without first being reviewed and approved by your legal team.

After you add a question to a question bank, you can reuse it in any assessment by dropping it into the assessment. You can create custom questions, add existing questions, or add and customize the sample questions that are included with the base system.

Activate the TPRM issue recommendation skill from ServiceNow Otto for TPRM to generate recommendations for TPRM issues.

When you create (or the system generates) a new record (for example, a request for due diligence or a task), the system auto-assigns a unique ID number that helps to identify the type of data in the record. You can use the ID number to search for or filter the item you want to work on.

Reference topics provide detailed descriptions of tables, properties, forms, and roles that are installed with the Third-party Risk Management application.

Request third-party risk due diligence to determine the level of risk for interactions with a third party, engagement, or fourth party by using Third-party Risk Management. You conduct due diligence to become aware of the associated risks so that you can make informed decisions, establish appropriate controls, and mitigate the potential negative impact when working with external parties.

Answer questions, modify responses, or submit external questionnaires for a third party or engagement by using Third-party Risk Management. You can save valuable time by responding for a third party or engagement when they have already provided the required information for a previous questionnaire.

Use the risk intelligence request form to capture all the information that you need to request risk intelligence using Third-party Risk Management. As a third-party risk manager, third-party risk assessor, and contract negotiator that is assigned to the due diligence request, you can request risk intelligence.

A third-party risk area criteria is a group of risk domains (sometimes called risk areas in other platform features) that applies to a particular type of third party.

A risk domain defines the type of risk to assess for a third party. For example, you might want to assess a data-management third party in terms of security risk and a bank in terms of financial risk. Security risk and financial risk are risk domains. Some platform applications refer to risk domains as "risk areas."

After you install the Risk concentration map feature, you must install a Google license to enable the feature.

A risk profile is a comprehensive assessment of the potential risks that are associated with a particular third party. To generate a risk profile, you evaluate and document several aspects of the third party's operations, practices, and relationships. The aim is to understand the level of risk they may pose to your organization.

The risk rating scale helps business users better understand risk assessment results. For example, in the default settings, risk scores in the 20 through 39 range indicate high risk, while scores in the 60 through 79 range indicate low risk.

Use the create new risk form to capture all the information that you need to associate a control with a third party or engagement using the Third-party Risk Management application. As a third-party risk admin, you can create a control.

Request a risk intelligence report (RIR) or score to gain insight on how trustworthy a particular third party can be as part of the due diligence request process by using the Third-party Risk Management application. By associating your RIR request with a due diligence request, all activity, scores, reports, and details are available for you to see.

Request a risk intelligence report (RIR) or score to gain insight on how trustworthy a particular third party can be using the Third-party Risk Management application.

Track sanction-related information as part of requesting risk intelligence reports and scores by using the Third-party Risk Management application. Logging and updating sanctions-related information for third parties keeps your team informed as you conduct due diligence as part of your third-party risk program.

Request risk intelligence reports or scores directly from your external risk intelligence content providers by using the Third-party Risk Management application. This information can be requested and managed based on the importance or risk level of the individual third party.

You add a raw score from a provider to the provider service record for a third party. The system uses the mapping that you specified to normalize the value to the appropriate TPRM rating.

Risk intelligence providers generate risk scores for a variety of third-party risk domains. Your organization can purchase services from providers that return data that is analogous to personal credit scores. The scores provide insight on how trustworthy and safe a particular third party can be.

Create a record for each risk intelligence provider from which you’ll request reports. The risk scores and ratings that risk intelligence providers generate are analogous to personal credit scores. The scores provide insight on how trustworthy and safe a particular third party can be.

After you register a risk intelligence provider and service, you specify the available request types that you and your organization will use.

After you register a risk intelligence provider, you specify which of the provider's scoring or rating services you’ll use. You also specify how their scores or ratings map to your TPRM ratings.

A provider-based submission rule is a set of conditions and actions. In a rule, you can specify that an update to a rating from a risk intelligence provider is the condition that triggers the action that is specified in the rule. The action might be to create and send a third-party risk assessment, issue, task, or email.

Assign roles to users before you implement or use the Third-party Risk Management application. Assigning roles in a well-organized manner simplifies and improves process management and helps to ensure that users are promptly notified of tasks in their areas of responsibility.

Roles determine permissions and access in TPRM.

The TPR manager and TPR admin roles involve a broad variety of responsibilities. After the TPRM base system is set up, you configure Smart Assessment Engine specific settings as well as other assessment settings that enable and enhance everyday risk-assessment tasks. TPRM admins can enable SAE and work with SAE templates.

With the integration of Smart Assessment Engine (SAE), TPRM now supports both the Classic assessment engine and SAE. You can create questionnaire templates and add instructions, questions, and reference information by creating templates using SAE in the Vendor Management Workspace.

Turn on SBOM collection on a due diligence request and send the external assessment to collect SBOM data from an engagement contact.

Third-party Risk Management (TPRM) collects software bill of materials (SBOM) files through engagement-level due diligence. This topic covers the users and workflow involved.

The records, related lists, and relationships created when you collect SBOM data in Third-party Risk Management, and how those records relate to engagements and third parties.

A software bill of materials provides an inventory of the components, libraries, and dependencies included in a vendor's software. Third-party Risk Management (TPRM) supports collecting SBOM files as part of the due diligence process.

Assign one or more approval levels to the users or groups that approve your due diligence requests in the Third-party Risk Management application. Because the approval levels are applied iteratively and each level contains different rules, you can help to ensure that the correct user or group is assigned as an approver.

Set up the rules at each approval level for your due diligence requests by selecting an approver type and the number of approvals that you require in the Third-party Risk Management application. You can also filter the table conditions that apply to each rule so that you can help ensure that the correct user or group is assigned as an approver.

Set up an internal questionnaire's responses to automatically attach questionnaires to external assessments that are based on the responses, the calculated risk tier, or both by using Third-party Risk Management. By setting up this configuration, you can help to improve your ability to respond to risk tier changes and internal questionnaire responses.

Share a dashboard with other users, groups, or roles to create a shared view of data that you can use to collaborate. You can grant viewing permissions or both viewing and editing permissions.

Third parties can use the Shared Assessments Standardized Information Gathering questionnaire (SIG) to provide assessment documentation in the Third-party Risk Management application. The third-party contact can upload the pre-filled SIG spreadsheet or respond to a form-based questionnaire that is imported to the instance.

Activate the TPRM summarization skill from ServiceNow Otto for TPRM to generate a brief summary of a TPRM issue by selecting the specific fields that you would like included in the summary.

Learn more about the key concepts and terms that are used in the TPRM application.

Set up your third-party contacts so that you can send assessments, address issues, and communicate any additional required information with these contacts using Third-party Risk Management.

Create a third-party element directly in the Elements grid in the Third-party Risk Management application. Third-party elements are assessed as part of the due diligence workflow.

Link a third-party element to an engagement by using the Third-party Risk Management application. After linking the element to an engagement, the third-party risk manager and internal stakeholders can assess it as part of the due diligence process.

Define criteria, based on risk scores, that determine which third parties require assessments. Third-party risk scoring rules apply to subsidiaries and engagements and to third-party risk areas.

Use a Microsoft Excel template to respond to questionnaires by downloading the template, completing it, and importing the final version into the Third-party portal. The Microsoft Excel questionnaire template contains instructions for filling out the template.

Use the Shared Assessments Standardized Information Gathering questionnaire (SIG) to provide assessment documentation on the third-party portal. You can upload the pre-filled SIG spreadsheet or import a form-based questionnaire.

The Elements grid displays dynamic fields when you add or edit an AI use case or AI model element in the Third-party Risk Management application.

Use the third-party element form to capture the information needed to create a third-party element record in the Third-party Risk Management application. As a third-party risk manager, third-party risk assessor, or due diligence request owner, you can create a third-party element record.

Run real-time validation on Register of Information (RoI) packages to help ensure compliance with DORA requirements.

Review and resolve Legal Entity Identifier (LEI) validation results for DORA Register of Information reporting. LEI validation runs automatically during Plain-CSV Reporting Package generation and Microsoft Excel upload to verify that LEI codes in the digital resilience registers exist in the GLEIF database and have an active and issued status.

The validation framework helps ensure that RoI packages meet regulatory requirements defined by the DORA.

You can review scores and risk ratings in your questionnaires to help ensure the accuracy and consistency of risk scoring by verifying the correct application of weights, normalized values, scoring methods, and risk rating scales. Based on the different weights you assign, Third-party Risk Management aggregates these values and produces a composite score.

TPRM includes sample questionnaires that you can use to define questionnaire templates for your organization.

The Third-party risk management (TPRM) processes provide a consistent framework for your third-party risk management program. You can customize the workflow processes to meet your organization's needs.

Questionnaires or document requests might require electronic signatures of third-party contacts and/or reviewers.

Third-party contacts use the Third-party portal to complete assessments and collaborate with the TPR manager in the comments section for each question. When assessments reveal gaps, the TPR manager or the TPR assessor can generate an issue or task. In addition, the Vendor Management Workspace application can auto-generate issues.

Protect your organization's interests, as the Third-party risk contract negotiator, often the corporate counsel, by incorporating specific contractual provisions so that you can address the risks identified using the Third-party Risk Management application.

The dashboards page displays the Third-party insights dashboard and TPRM custom analytics dashboard as well as any other dashboards you and your team create.

TPR managers and assessors use the due diligence management reports to track, prioritize, and manage their responsibilities.

You can view the list of users who can approve or reject a DD request and also view the details of their approval actions. In addition, you can view the approval levels for a request.

You can view the contracts associated with each engagement or third party and alongside detailed information such as the expiration, start date, end date, and state. You can also manage and update contract processes.

From the Details tab, you can view and adjust the due diligence request information for a third party. You can also log external-facing comments and private work notes, attach files, and track request updates in the activity stream.

After the IRQ process is complete, you send questionnaires and document requests to the third-party contact. You manage the third-party risk assessment by working with the contacts to help ensure that the responses are complete and accurate.

The first internal step after an engagement request is approved is to start the IRQ process to scope the risk by determining the third party's risk score.

TPR managers and TPR admins can perform a wide variety of tasks from the due diligence management dashboard. They can work on all processes in the workflow for a due diligence request: IRQs, external due diligence, approval, contract risk, and closed requests.

You can view a list of risk intelligence report (RIR) requests, their associated providers, scores, and report URLs. In addition, you can create requests and make updates by using the Third-party Risk Management application.

Use the engagement page to access all current information and status for an engagement.

The home page displays reports of important risk information and provides quick access to actions for TPR managers and TPR assessors.

Create an issue to help ensure that your concerns about a third party or engagement are remediated.

Verify that an issue that is associated with a risk assessment is understood, communicated to the appropriate persons, and is acted on as needed.

The List page is a general-purpose page that enables access to all items that you can view or act on in TPRM.

Request due diligence to assess the risk that is associated with doing business with an engagement. By conducting due diligence, you gain access to the most up-to-date, comprehensive, and accurate information before making a decision on entering into a business relationship.

The Risk activity page enables you to quickly identify assessments, issues, and tasks that need attention.

The Risk concentration map page pinpoints the geographical locations of active third parties and engagements. You can configure filters to view particular risk ratings and engagement types.

The Risk overview tab displays engagement name and process information, summary reports, risk intelligence scores, and tracking data for issues and tasks. On most reports, you can select an item to view the underlying data.

For DD requests, risk intelligence scores appear in a list. For an individual third party, a card displays the most recent score or rating and a link for each risk intelligence report.

The Details tab displays overview and process tracking information and offers actions for managing the third party or engagement. On most reports, you can select an item to view the underlying data.

The Downstream suppliers tab displays overview information on fourth parties that the third party engages with. On most reports, you can select an item to view the underlying data.

The Risk overview tab displays third-party name and process information, summary reports, risk intelligence scores, and tracking data for issues and tasks. On most reports, you can select an item to view the underlying data.

The Subsidiaries tab displays overview information on subsidiaries of the third party. On most reports, you can select an item to view the underlying data.

Create a task to help ensure that a user at your organization or the third-party contact responds to your concerns about questionnaire responses or requested documents during the due diligence process.

Verify that the Assigned to user at your organization or the third-party contact responds to a task and update the state of the task as needed.

The task page gives you access to tasks that are assigned to you and to members of your group. You can further filter the lists of tasks by due diligence requests, type of third-party action, and by risk or tiering assessment.

Use the third party page to access all current information and status for a third party.

The unified content management page provides access to a centralized library of smart assessment templates. You can use this library to activate ready‑to‑use questionnaires aligned with global regulations and industry standards, helping ensure consistent and comprehensive assessments.

Reopen an assessment to send out more questionnaires and document requests to collect required additional information from the third party or engagement.

Use the Risk tab on the Vendor Management Workspace to access and prioritize activities such as managing your portfolio of third parties, assessing third-party risk, and completing the remediation life cycle. The workspace enables automation that reduces the manual burden and costs of risk assessment.

Third-party contacts respond to questionnaires, requests for documentation, tasks, and issues on the Third-party portal. The portal is the point of interaction between third parties and risk assessors.

Perform a comprehensive external risk assessment when calculating multiple ratings and scores by using the Third-party Risk Management application. You can gain a deeper understanding of the overall calculation process and learn how user-defined parameters and configurations influence the results of the questionnaires.

The Vendor Risk Overview page is replaced by the third-party risk reports on the Vendor Management Workspace.

Activating the Third-party Risk Management plugin also installs the Explicit Roles plugin. Administrators assign the snc_internal and snc_external roles to provide internal and external users access to the instance.

A third-party risk management program can help you to proactively identify, assess, and mitigate the risks that are associated with your relationships with third parties. By effectively managing third-party risks, you can enhance your overall resilience, protect your interests, and create sustainable and trustworthy business relationships.

While onboarding a particular third party, you might conduct a separate engagement for each distinct type of relationship that you have with the third party. One engagement is to assess the risk involved in the third party's development of software for your organization and a separate engagement is for the facilities management service that they provide.

Conducting due diligence on third parties is a crucial component of your comprehensive third-party risk program. You conduct due diligence to become aware of the risks that are associated with a third party so that you can confidently decide how to form your relationship.

Acme, a large manufacturing company, is in the process of onboarding a new third party to supply critical components for their production line. To help ensure the third party's reliability and to mitigate potential risks, Acme starts a thorough third-party risk management onboarding process.

When implementing your third-party risk management program, you must carefully consider the regulations. Applicable regulations vary depending on your industry, geographic location, jurisdiction, and nature of your operations.