Looking for best practices for managing large numbers of engagements under a vendor
Colleagues who work in TPRM in my organization are dismayed that some of our third-party vendor records have dozens of engagements associated with them (sometimes 50+). As a result, it's becoming increasingly difficult for users to:
- Quickly locate an existing engagement.
- Determine whether a new assessment should be created under an existing engagement.
- Decide when a new engagement should be created instead.
The current proposal is to retire old engagements and have users filter their views to display only active engagements.
I've been testing engagement retirement/reactivation, and unlike say retiring entities, it appears changing the state of an engagement to 'retired' only changes the engagement record (specifically its status) and does not affect other records. Is that understanding correct?
I'm interested in hearing how others manage engagement sprawl under vendors. Specifically:
- Do you retire old engagements, or use another approach?
- Are there any drawbacks or unintended consequences to retiring and later reactivating engagements?
- What naming conventions, governance processes, or other best practices have you implemented to keep engagements organized and easy to navigate?
I'd appreciate any recommendations or lessons learned from organizations managing a large volume of engagements in ServiceNow GRC.
