TPRM Vendor Issues and IRM Risk Events – Capabilities and Implementation Approach

Mansor2
Tera Contributor

3 weeks ago

Hi Community,

Our customer is considering TPRM and IRM Professional. When a vendor fails a contractual obligation—for example, a missed SLA or a data-loss event, they want to record the issue, track corrective actions, and provide enterprise-level visibility of the occurrence, impact and associated risks. The customer refers to this as an operational “incident,” not an ITSM incident.

Our packaging map shows Advanced Risk Management as “Limited” in Professional and included in Enterprise, but does not list Risk Event Management separately. Given the significant price difference, we would appreciate clarification on:

  1. Is Risk Event Management a dedicated capability within Advanced Risk Management? Which edition includes it, and is a standalone or add-on subscription available?

  2. Is there an OOTB mechanism to create or link an IRM Risk Event from a TPRM issue?

  3. Could this scenario be supported using TPRM and IRM Professional’s existing capabilities, without creating a separate Risk Event record?

Practical implementation examples would be helpful, particularly the extent of customization required,such as additional fields, relationships, workflows, scripts or tables,to support this scenario using TPRM and IRM Professional.

0 Helpfuls
  • 383 Views
1 REPLY 1

sanjaygupta
Mega Guru

7 hours ago

 

I'd look at this from two angles: managing vendor issues and tracking formal operational risk events. TPRM Issue Management and IRM Risk Event Management support related but different purposes.

For your scenario, TPRM already provides OOTB functionality to record vendor issues, assign corrective actions, track remediation and monitor closure. You don't necessarily need a separate Risk Event record.

Regarding licensing, ServiceNow's Risk Product Entitlements guide indicates that:

  • IRM Professional includes Advanced Risk Management and Issue Management.

  • IRM Enterprise includes Risk Event Management.

The OOTB Risk Event Integration framework supports integrations with upstream records, but TPRM issue integration may require additional configuration or customization.

If you want to stay with Professional, I'd suggest:

  • Use TPRM Issue records to capture vendor failures.

  • Add fields for occurrence date, business impact and root cause.

  • Use remediation tasks to track corrective actions.

  • Build reports and dashboards for enterprise visibility.

  • Link issues to the relevant vendor and risk records.

This should cover issue tracking and remediation. However, dedicated Risk Event capabilities, including loss-event tracking and associated reporting, may require Enterprise.

My recommendation is to stick with TPRM Issue Management if the requirement is primarily vendor issue tracking. Consider Enterprise if the customer needs formal operational risk event management.

I'd also confirm the latest licensing entitlements with your ServiceNow account representative before finalizing the solution.

 
Hope you find this helpful.
0 Helpfuls