Define third-party risk scoring rules
Define criteria, based on risk scores, that determine which third parties require assessments. Third-party risk scoring rules apply to subsidiaries and engagements and to third-party risk areas.
Before you begin
Role required: sn_vdr_risk_asmt.vendor_risk_manager
Procedure
-
Navigate to All > Third-party Risk Management > Scoring Setup > Third-party Risk Scoring Rules.
-
Select New, fill in the form, and then select Submit.
Note: If a different scoring rule already applies to a third party, changing which rule applies triggers a full recalculation of that third party's score tree, including its engagements and elements, using the existing scheduled/manual full vendor-tree recalculation job. Risk areas that aren't part of the newly applied rule's criteria no longer contribute to the score.
|
Field |
Description |
|---|---|
|
Name |
Name of the scoring rule. |
|
Description |
Description of the scoring rule that will help other users understand its intent. |
|
Number |
For each third-party risk scoring rule, the system auto-assigns a unique ID number that starts with the text VRS.The unique ID is used in all references to the item. You can use the ID to search or filter for the item that you want to work on. |
|
Third-party risk area criteria |
The risk area criteria that applies to this engagement risk scoring rule. A third-party risk area criteria is a group of risk domains (sometimes called risk areas in other platform features) that applies to a particular type of third party. See Define third-party risk area criteria for details on how the criteria are defined. |
|
Third-party risk component criteria |
Criteria for third-party risk assessments, engagements, and subsidiaries that applies to this risk scoring rule. Components are the entities for which you can assess risk (for example, subsidiaries or engagements). A component criteria is a group of components that should apply to a particular type of third party or engagement. |
|
Active |
Option to activate the rule. Only active rules are applied. |
|
Order |
Select the order to indicate the rule's precedence. If multiple rules apply to the same third-party risk area, engagement, or subsidiary, the one with the higher-order value is applied. |
|
Vendor filter |
Use the condition builder to define the rules for selecting third parties. For example, you can filter on third parties with whom you do considerable business (Size is $1,000,000) or third parties within a specific category (Category is software). |
---
title: Define third-party risk scoring rules
description: Define criteria, based on risk scores, that determine which third parties require assessments. Third-party risk scoring rules apply to subsidiaries and engagements and to third-party risk areas.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/governance-risk-compliance/third-party-risk-management/tprm-tp-risk-scoring-rules-define.html
release: australia
product: Third-party Risk Management
classification: third-party-risk-management
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Classic assessments, Configure, Third-party Risk Management, Governance, Risk, and Compliance]
---
# Define third-party risk scoring rules
Define criteria, based on risk scores, that determine which third parties require assessments. Third-party risk scoring rules apply to subsidiaries and engagements and to third-party risk areas.
## Before you begin
Role required: sn\_vdr\_risk\_asmt.vendor\_risk\_manager
## Procedure
1. Navigate to **All** > **Third-party Risk Management** > **Scoring Setup** > **Third-party Risk Scoring Rules**.
2. Select **New**, fill in the form, and then select **Submit**.
**Note:** If a different scoring rule already applies to a third party, changing which rule applies triggers a full recalculation of that third party's score tree, including its engagements and elements, using the existing scheduled/manual full vendor-tree recalculation job. Risk areas that aren't part of the newly applied rule's criteria no longer contribute to the score.
<table id="table_eng-scoring-rule"><thead><tr><th>
Field
</th><th>
Description
</th></tr></thead><tbody><tr><td>
Name
</td><td>
Name of the scoring rule.
</td></tr><tr><td>
Description
</td><td>
Description of the scoring rule that will help other users understand its intent.
</td></tr><tr><td>
Number
</td><td>
For each third-party risk scoring rule, the system auto-assigns a unique ID number that starts with the text VRS.The unique ID is used in all references to the item. You can use the ID to search or filter for the item that you want to work on.
</td></tr><tr><td>
Third-party risk area criteria
</td><td>
The risk area criteria that applies to this engagement risk scoring rule.
A third-party risk area criteria is a group of risk domains \(sometimes called risk areas in other platform features\) that applies to a particular type of third party. See [Define third-party risk area criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-risk-domain-criteria-df.md) for details on how the criteria are defined.
</td></tr><tr><td>
Third-party risk component criteria
</td><td>
Criteria for third-party risk assessments, engagements, and subsidiaries that applies to this risk scoring rule.
Components are the entities for which you can assess risk \(for example, subsidiaries or engagements\). A component criteria is a group of components that should apply to a particular type of third party or engagement.
See [Define component criteria](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-component-criteria-define.md).
</td></tr><tr><td>
Active
</td><td>
Option to activate the rule. Only active rules are applied.
</td></tr><tr><td>
Order
</td><td>
Select the order to indicate the rule's precedence. If multiple rules apply to the same third-party risk area, engagement, or subsidiary, the one with the higher-order value is applied.
</td></tr><tr><td>
Vendor filter
</td><td>
Use the [condition builder](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-user-interface/c_ConditionBuilder.md) to define the rules for selecting third parties. For example, you can filter on third parties with whom you do considerable business \(Size is $1,000,000\) or third parties within a specific category \(Category is software\).
</td></tr></tbody>
</table> \[Omitted image "new-vendor-risk-scoring-rule.png"\] Alt text: New third-party risk scoring rule.
| title | Define third-party risk scoring rules |
| description | Define criteria, based on risk scores, that determine which third parties require assessments. Third-party risk scoring rules apply to subsidiaries and engagements and to third-party risk areas. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/governance-risk-compliance/third-party-risk-management/tprm-tp-risk-scoring-rules-define.html |
| release | australia |
| product | Third-party Risk Management |
| classification | third-party-risk-management |
| topic_type | task |
| last_updated | 2026-09-10 |
| reading_time_minutes | 2 |
| breadcrumb | Classic assessmentsConfigureThird-party Risk ManagementGovernanceRiskand Compliance |