Manually add a risk to a third party or engagement

If you’re using both Risk Management and Third-party Risk Management, you can associate risks and risk statements with third parties and engagements. These associations influence risk posture and scoring.

Before you begin

Role required: admin or sn_vdr_risk_asmt.vendor_risk_admin

About this task

When you associate a risk with a third party or engagement, the risk becomes part of the entity’s risk profile and can be included in scoring calculations. This does not automatically trigger assessments unless configured through TPRM rules.

Controls are automatically generated when you associate a policy with an entity type or an entity type with a control objective. A control is created for each entity listed in the entity type for the control objective. Controls can also be manually created.

For more information on creating risk statements and risks in Risk Management, see Create a risk statement, Create a risk manually, and Generate a risk from a risk statement.

To understand the difference between a control objective and a control, see Relationship between risks, risk events, and risk statements.

Procedure

Navigate to Workspaces > Vendor Management Workspace.
Select the list icon ([Omitted image "ws-list-icon.png"] Alt text: List icon.) and then navigate to Third parties > All third parties or Engagements > All engagements.
Select the third party or engagement that you want.
Navigate to the Risks tab of the third party or engagement.
Assign a risk to the engagement by selecting New.
On the form, fill in the fields.

For descriptions of all these fields, see Create new risk form.
Select Submit.

For more information on managing risks, see Manage risks, risk statements, and risk frameworks.

The risk is created and all related lists are visible.

Create new risk form
Use the create new risk form to capture all the information that you need to associate a control with a third party or engagement using the Third-party Risk Management application. As a third-party risk admin, you can create a control.

Parent Topic:Integrating Third-party Risk Management with Risk Management

Create new risk form

Define the risk appetite for a risk

Create a risk statement

Define the risk appetite for a risk statement

title	Manually add a risk to a third party or engagement
description	If you’re using both Risk Management and Third-party Risk Management, you can associate risks and risk statements with third parties and engagements. These associations influence risk posture and scoring.
locale	en-US
canonical_url	https://www.servicenow.com/docs/r/governance-risk-compliance/third-party-risk-management/tprm-add-risks-tp.html
release	brazil
product	Third-party Risk Management
classification	third-party-risk-management
topic_type	task
last_updated	2026-09-10
reading_time_minutes	3
breadcrumb	TPRM with Risk ManagementIntegrateThird-party Risk ManagementGovernanceRiskand Compliance