--- sourceDocument: Zurich Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/governance-risk-compliance Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Request due diligence # Requesting third-party risk due diligence {#ariaid-title1} Release version: Zurich Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Requesting third-party risk due diligence Requesting third-party risk due diligence using Third-party Risk Management helps your organization evaluate the risk associated with interactions involving third parties, engagements, or fourth parties. This process is essential to make informed decisions, establish controls, and mitigate risks from external business relationships. Any employee can initiate due diligence for an engagement, which is a business relationship that could expose your organization to risks. Third parties include any external organizations or individuals, their subsidiaries, and further downstream parties (fourth parties and beyond) that might impact your risk landscape. Show full answer Show less When AI assets are involved in the engagement, the process requires identifying AI use cases and assigning an internal user to respond to the Inherent Risk Questionnaire (IRQ), ensuring both AI and IRQ tasks are completed before proceeding. ## Due Diligence Request Process * An employee requests due diligence for a third-party engagement. * The requester and the assigned due diligence group receive email notifications. * A Third-party Risk (TPR) manager or assessor is assigned to own and review the request. * The TPR manager approves or rejects the request based on provided information. * Upon approval, the IRQ process begins; additional assessments such as Software Bill of Materials (SBOM) may be required depending on your organization's configuration. ## Request Options * **Onboard a new engagement:** Start onboarding a new engagement with an existing third party. * **Reassess an existing engagement:** Conduct due diligence when conditions change or adverse information arises. * **Reassess for contract renewal:** Evaluate risk before renewing contracts to ensure ongoing suitability. * **Offboard an engagement with due diligence:** Determine if terminating the relationship is optimal, considering risks and potential disruptions. * **Offboard an engagement without due diligence:** Request termination of an engagement without additional due diligence when switching third parties or engagements, with IRQ confirmation that services will cease. ## Practical Insights for ServiceNow Customers This due diligence functionality enables you to systematically manage third-party risks by tracking requests using unique DDR IDs, facilitating communication with reviewers, and attaching relevant documentation. It integrates with risk assessment workflows like the IRQ and can include customized assessments such as SBOM for software supply chain risk. Using these processes helps your organization maintain compliance, reduce exposure to external risks, and make evidence-based decisions regarding third-party engagements throughout their lifecycle. Request third-party risk due diligence to determine the level of risk for interactions with a third party, engagement, or fourth party by using Third-party Risk Management. You conduct due diligence to become aware of the associated risks so that you can make informed decisions, establish appropriate controls, and mitigate the potential negative impact when working with external parties. Any employee at your organization can request due diligence, which is an investigation or examination of business relationship risk, for an engagement. * An engagement is the informal or contracted relationship that you intend to form with a third party that could potentially expose your organization to risk. The engagement outlines the services or products to be provided by the third party and other details of the relationship. * A third party is any organization or individual that you have interacted or entered into a business relationship with. Third parties can have subsidiaries and can contract with fourth parties. For example, departments are subsidiaries. * A fourth party can contract with further parties. All downstream parties, such as the fourth through the nth parties, carry risk in the same ways as third parties. * Third-party elements (TP elements) are the external organizations that an engagement relies on to provide goods, services, or support. These organizations can include the suppliers, contractors, facilities, individuals, or any other external organization that can access the engagement's systems, data, or facilities. {#tprm-requesting-tpr-due-diligence__ul_pvt_mxy_21c} Note: If AI assets are involved in the engagement, the requester selects AI assets involved when creating the due diligence request and identifies the internal user who responds to the Inherent Risk Questionnaire (IRQ). This adds a paired internal task that assigns the due diligence requester to add AI use case elements, alongside the IRQ process. Both must be complete before due diligence can continue. For more information, see [Monitoring third-party elements](https://www.servicenow.com/docs/Yfp~n_hbxXXKwPuC4N0CLA "Monitor third-party elements using scalable scoring models, relationship analysis, and due diligence workflow integration in the Third-party Risk Management application to conduct more informed risk assessments as part of your third-party risk program."). For more information about the terms that are used in these sections or why you might conduct due diligence, see [Terminology](https://www.servicenow.com/docs/ESVX_kQkGALx7rrXJl3UIg "Learn more about the key concepts and terms that are used in the TPRM application.") and [Why you conduct due diligence](https://www.servicenow.com/docs/4R0CWp~NuipqRG1GQDaS3g "Conducting due diligence on third parties is a crucial component of your comprehensive third-party risk program. You conduct due diligence to become aware of the risks that are associated with a third party so that you can confidently decide how to form your relationship."). The following infographic shows the due diligence request process.
The following are the steps of the due diligence request process. 1. An employee at your organization requests due diligence for a third-party engagement. 2. The system sends an email notification to the employee who made the request. 3. The system sends an email notification to the Due diligence request assignment group. 4. A member of the group can assign a Third-party risk (TPR) manager \[sn_vdr_risk_asmt.vendor_risk_manager\] or TPR assessor \[sn_vdr_risk_asmt.vendor_assessor\] to act as the owner of the request. 5. The system sends an email notification to the assigned owner of the due diligence request. 6. The TPR manager reviews the request for due diligence for the engagement and approves it. If the information provided by the requester was insufficient or the engagement is not possible for your organization, the TPR manager rejects it. 7. The IRQ process starts after the TPR manager approves the request for due diligence. {#tprm-requesting-tpr-due-diligence__ol_xzs_3ft_cjc} Note: Depending on how due diligence is configured in your organization, additional assessments or information requests may be included as part of the due diligence process. For example, organizations that manage software supply‑chain risk might request a Software Bill of Materials (SBOM) from third parties as part of due diligence. For more information, see [Exploring software bill of materials collection](https://www.servicenow.com/docs/ZRNwVzBx~5cbL~D5wm10TA "Third-party Risk Management (TPRM) collects software bill of materials (SBOM) files through engagement-level due diligence. This topic covers the users and workflow involved.") and [Collecting software bill of materials](https://www.servicenow.com/docs/NTs1eUgIGFaOQqt8f77TAQ "A software bill of materials provides an inventory of the components, libraries, and dependencies included in a vendor's software. Third-party Risk Management (TPRM) supports collecting SBOM files as part of the due diligence process."). When creating a due diligence request, the following options are available: * Onboard a new engagement Start the onboarding process for a new engagement with an existing third party. For more information about this type of onboarding, see [Example: Onboarding a third party](https://www.servicenow.com/docs/pQPUcYj1Zkgpb22~Uzivwg "Acme, a large manufacturing company, is in the process of onboarding a new third party to supply critical components for their production line. To help ensure the third party's reliability and to mitigate potential risks, Acme starts a thorough third-party risk management onboarding process."). * Reassess an existing engagement Reassess an existing engagement when the conditions change. For example, let's say that you hear adverse news or have changes in your third-party's supply lines. You might want to reassess the risk by conducting additional due diligence. * Reassess an existing engagement for contract renewal Reassess the risk before your organization renews the contract with a current third party or engagement by conducting due diligence. * Offboard an engagement with due diligence Determine if offboarding (terminating the relationship) with an engagement is the optimal course of action by conducting due diligence. For example, it might be too risky to switch third parties or engagements even if their current performance doesn't meet expectations. Extenuating circumstances can contribute to the decision. For example, if the third party is sourcing materials that are difficult to obtain, switching providers might be costly and introduce additional risks. In such cases, continuing with the existing third party, with whom a long-term relationship exists, might be preferable to mitigate potential disruptions and higher risks. * Offboard an engagement with no due diligence Request that an engagement be permanently terminated when an engagement ends or you want to switch to a different third party for other reasons. In this case, you typically don't need to conduct additional due diligence. The process does, however, include the normal Inherent Risk Questionnaire (IRQ) process to confirm that the services provided by the engagement will no longer continue. For more information about this type of offboarding, see [Offboarding an engagement without conducting due diligence](https://www.servicenow.com/docs/7S3f0VSmNw9H_rxHjzEN4w "Request that an engagement be permanently terminated when an engagement ends or you want to switch to a different third party for other reasons. In this case, you typically don't need to conduct additional due diligence. The process does, however, include the normal Inherent Risk Questionnaire (IRQ) process to confirm that the services provided by the engagement will no longer continue."). {#tprm-requesting-tpr-due-diligence__ul_pjp_g1f_pzb} To learn more about creating or monitoring a due diligence request, see [Request due diligence for a third-party engagement](https://www.servicenow.com/docs/SVcVA_VcLPqQO8OTzjJ46Q "Request due diligence to assess the risk that is associated with doing business with an engagement. By conducting due diligence, you gain access to the most up-to-date, comprehensive, and accurate information before making a decision on entering into a business relationship.") and [Monitoring the due diligence request process](https://www.servicenow.com/docs/Z_uslRla7H6cKjJ~MhfD3A "TPR managers and TPR admins can perform a wide variety of tasks from the due diligence management dashboard. They can work on all processes in the workflow for a due diligence request: IRQs, external due diligence, approval, contract risk, and closed requests."). For each due diligence request, the system auto-assigns a unique ID number that starts with the text DDR. Use the ID to track your request. You can post a message to reviewers and add attachments from the page. The following example shows how a new due diligence request appears. Figure 1. Due diligence request tracking example For more information on the different processes that make up the overall due diligence workflow, see [Due diligence workflow](https://www.servicenow.com/docs/oa2CJCPg4eVC9NKnvL3_PQ "The Third-party risk management (TPRM) processes provide a consistent framework for your third-party risk management program. You can customize the workflow processes to meet your organization's needs.") and [Assessing your third-party risk](https://www.servicenow.com/docs/Irep7LZWyN_XTR9KnfuuVg "Use Third-party Risk Management to identify and assess potential risks that are associated with your third-party relationships. The information gathered from internal questionnaires, external questionnaires, and documentation requests helps you to understand the third party's risk profile, determine the appropriate risk mitigation strategies, and determine whether the third party or engagement meets all necessary compliance requirements.").