--- sourceDocument: Zurich Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/governance-risk-compliance Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Monitoring third-party elements # Monitoring third-party elements {#ariaid-title1} Release version: Zurich Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 7 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Monitoring third-party elements The Third-party Risk Management application enables ServiceNow customers to monitor third-party elements (TP elements), which are external organizations or entities involved in providing goods, services, or support that impact an engagement. TP elements include suppliers, contractors, facilities, individuals, or any external party with access to systems, data, or facilities. Monitoring these elements helps conduct informed risk assessments as part of a comprehensive third-party risk program. Show full answer Show less ## Third-party Elements and Their Importance * **Types of TP Elements:** Examples include datacenters (Facility), manufacturing facilities (Facility), beneficial owners (Principal), AI use cases, and AI models. * **Risks:** Each element class carries unique risks such as data breaches, supply chain disruptions, compliance issues, or operational influence, which require targeted controls and due diligence. ## Collecting and Managing TP Elements * Collecting TP elements is optional and can be done directly in the Elements grid or via assigned tasks to due diligence requesters or third-party contacts. * AI assets involved in engagements trigger specific workflows, including internal assessments and tasks to add AI use case elements. * After internal assessments, further element collection or due diligence can be initiated, with third-party contacts managing element data through assigned tasks. * TP elements can be created at the engagement level (automatically linked) or third-party level (requiring manual linking to engagements for assessment). ## Element-scoped Assessments, Issues, and Tasks * Assessments, issues, and tasks can be scoped specifically to TP elements when using the Smart Assessment Engine (SAE), allowing more granular risk evaluation. * Element-scoped records require specifying the related element and enable evidence capture linked to both third party and element. * Third-party and engagement contacts can respond to element-level assessments via the third-party portal similarly to engagement-level assessments. ## TP Element Scoring and Risk Calculation * TP elements are categorized into Facility, Product, Principal, or Other to streamline assessment criteria and scoring. * Element scoring averages risk ratings from the latest third-party risk assessments per questionnaire template, excluding duplicates for accuracy. * Risk scores roll up from TP elements to the third party and engagements through relationship scores, calculated using the engagement's scoring rule and criticality. * Linking a TP element to an engagement dynamically calculates and updates risk ratings without requiring new assessments. * The system supports multiple engagements per element, applying component criteria at the classification level to influence overall engagement risk scores. * Reassigning scoring rules triggers recalculations across relevant scores, ensuring up-to-date risk data. * Custom TP element classifications and scoring weights can be defined to meet specific risk management requirements. ## Practical Benefits for ServiceNow Customers * Enables precise risk assessments by focusing on individual third-party elements rather than only on entire third parties or engagements. * Supports integration of AI asset considerations into risk workflows, reflecting modern third-party risks. * Provides dynamic, real-time risk scoring that adjusts as TP elements are linked or unlinked to engagements or as assessments are updated. * Improves risk visibility and control by allowing granular evidence collection, scoring, and issue tracking at the element level. * Facilitates efficient due diligence processes through task automation and role-based assignment of collection and assessment activities. Monitor third-party elements using scalable scoring models, relationship analysis, and due diligence workflow integration in the Third-party Risk Management application to conduct more informed risk assessments as part of your third-party risk program. ## Third-party elements overview {#tprm-monitor-tp-elements__section_ad5_bpf_bbc} Third-party elements (TP elements) are the external organizations or entities that an engagement relies on to provide goods, services, or support. TP elements can include the suppliers, contractors, facilities, individuals, or any other external organization that can access the engagement's systems, data, or facilities. Examples of TP element classes and associated risks: Datacenter : A facility or location where an engagement or third party outsources the storage, processing, and management of their data and IT infrastructure. A datacenter could potentially experience a data breach, downtime, or compliance violation that exposes their engagements to unexpected risk. This example would be classified as a Facility TP element. Manufacturing facility : A facility or location where an engagement or third party outsources the production or assembly of their products. A manufacturing facility could potentially experience a supply chain disruption, a counterfeit part, or a regulatory compliance issue that exposes their engagements to unexpected risk. This example would be classified as a Facility TP element. Beneficial owner : An individual who owns or controls an organization that is involved in a business relationship or transaction. These individuals may not be the registered or legal owners of the organization, but have significant influence or control over its operations, decision-making, or financial affairs. This example would be classified as a Principal TP element. AI use case : An AI system or application that a third party or engagement uses as part of its operations. AI use case elements capture information that domain experts need to review as part of your due diligence process. AI model : An AI model that an AI use case relies on. Select Global AI model to make it available for linking to AI use case elements across multiple third parties. Leave it cleared to make it available only within the third party where it was created. For more information on TP elements and examples of their associated controls and potential risks, see [Terminology](https://www.servicenow.com/docs/ESVX_kQkGALx7rrXJl3UIg "Learn more about the key concepts and terms that are used in the TPRM application."). ## Collecting and reviewing third-party elements {#tprm-monitor-tp-elements__section_cpb_drf_bbc} Collecting TP elements is optional. You can add elements directly, or assign the work through a task to the due diligence requester or a third-party or engagement contact. Note: The ability to create TP elements by reviewing collection questionnaire responses was removed in the Brazil release. TP elements are created directly, either in the Elements grid or through a task. To collect TP elements: 1. If AI assets are involved in the engagement, the due diligence requester selects AI assets involved when creating the due diligence request. The requester also identifies the internal user who responds to the Inherent Risk Questionnaire (IRQ). 2. The due diligence request owner selects Start onboarding. An internal assessment is created for the IRQ process. If the requester selected AI assets involved, an internal task is also created, assigning the due diligence requester to add AI use case elements. 3. The IRQ responder completes the internal assessment. If an internal task for AI use cases was created, the due diligence requester completes the task by adding AI use case elements directly in the Elements grid. For more information, see [Create a task for an internal user](https://www.servicenow.com/docs/Cxl0fixZRT6su9M6ziX_qA "Create an internal task to assign follow-up work to an internal user, rather than to a third-party contact, as part of your organization's third-party risk processes."), [Manage a task for a third party or engagement](https://www.servicenow.com/docs/3dCu0OO~wpdu62wwRRI2xQ "Verify that the Assigned to user at your organization or the third-party contact responds to a task and update the state of the task as needed."), [Manage elements in the grid](https://www.servicenow.com/docs/cKOEZ7GT6A7AdsU~~8fR5g "Manage third-party elements in the Elements grid by adding, editing, and deleting records. You can also link AI models to AI use case elements in the Third-party Risk Management application."), and [Complete an element collection task](https://www.servicenow.com/docs/ThFaEIyzd18oMPgscsg_xQ "Element collection tasks let internal users add AI use case elements and let third-party or engagement contacts add elements on behalf of the third party in the Third-party Risk Management application."). 4. After the internal assessment and, if applicable, the internal task for AI use cases are complete, the due diligence request owner can select Start collection or Start due diligence. 5. To collect more elements from the third party or engagement, the due diligence request owner selects Start collection. The system creates a task and assigns it to a third-party or engagement contact. 6. The third-party or engagement contact completes the task by selecting Manage elements on the task to open the Elements grid, adding or editing elements, and then selecting Resolve Task. For more information, see [Complete an element collection task](https://www.servicenow.com/docs/ThFaEIyzd18oMPgscsg_xQ "Element collection tasks let internal users add AI use case elements and let third-party or engagement contacts add elements on behalf of the third party in the Third-party Risk Management application."). 7. When ready to begin element-level assessments, the due diligence request owner selects Start due diligence. An assessment is created only for elements marked as Assessment required. {#tprm-monitor-tp-elements__ol_d2m_5kv_bcc} The process for assessing elements is the same as assessing any other third-party risk area. For more information on assessments, see [Assessing your third-party risk](https://www.servicenow.com/docs/Irep7LZWyN_XTR9KnfuuVg "Use Third-party Risk Management to identify and assess potential risks that are associated with your third-party relationships. The information gathered from internal questionnaires, external questionnaires, and documentation requests helps you to understand the third party's risk profile, determine the appropriate risk mitigation strategies, and determine whether the third party or engagement meets all necessary compliance requirements."). ## Adding third-party elements to engagements {#tprm-monitor-tp-elements__section_gyl_5pp_4bc} You can create a TP element from either of the following locations: * From an engagement's Elements tab. An element created this way is linked to that engagement automatically. * From the third party's Elements grid. An element created this way isn't linked to any engagement by default. {#tprm-monitor-tp-elements__ul_lky_dtb_gkc} If you create an element at the third-party level, the element isn't available for assessment until you link it to an engagement. In the engagement's Elements tab, select Add to link an existing TP element to that engagement. For more information, see [Add a third-party element record to an engagement](https://www.servicenow.com/docs/CghQLdh9d~tH4zBUWysCrQ "Link a third-party element to an engagement by using the Third-party Risk Management application. After linking the element to an engagement, the third-party risk manager and internal stakeholders can assess it as part of the due diligence process.") and [Manage elements in the grid](https://www.servicenow.com/docs/cKOEZ7GT6A7AdsU~~8fR5g "Manage third-party elements in the Elements grid by adding, editing, and deleting records. You can also link AI models to AI use case elements in the Third-party Risk Management application."). After you link the elements to an engagement, you can start the due diligence process for those elements. ## Element-scoped assessments, issues, and tasks {#tprm-monitor-tp-elements__section_element_scoped_records} Assessments, issues, and tasks can be scoped to a TP element instead of an engagement. When a record is scoped to an element, the Element field is visible and required. This scope is available only when the third party uses the Smart Assessment Engine (SAE). When SAE isn't in use, the element option isn't available for external assessments, issues, or tasks. Element evidence is captured against the third party and element. The record's contribution to a specific engagement is calculated from the element-engagement relationship, not tied to the engagement directly. Existing behavior for assessments, issues, and tasks scoped to a third party or to an engagement is unchanged. Third-party and engagement contacts can respond to element-scoped assessments in the third-party portal in the same way they respond to engagement-scoped assessments. When a questionnaire template is sent to an element more than once, the system checks whether the previous respondent is still a primary contact. If so, the questionnaire is assigned to that contact again. If they're no longer a primary contact, the questionnaire is assigned to the current primary contact instead. ## Third-party element scoring {#tprm-monitor-tp-elements__section_tyt_ymp_4bc} You can categorize each TP element into one of the following types: Facility, Product, Principal, or Other. This classification helps you organize the assessment criteria and subsequent scoring. Scoring on a TP element is determined by averaging the risk ratings from its associated third-party risk assessments. If you conduct multiple assessments for the same TP element, the system scores only the latest assessment for each questionnaire template, based on assessment close date. Duplicate assessments are excluded. This approach maintains a current risk rating for the TP element. For example, if a TP element has assessments with risk ratings of Very High and Very Low, the average leads to an overall risk rating of Moderate. TP element assessment scores roll up to the third-party level through relationship scores calculated from questionnaire-level evidence. An assessment sent on a TP element calculates a risk rating using the third party's scoring rule. This rating is informational only and doesn't roll up on its own. When a TP element is linked to an engagement, the engagement's risk rating for that element-engagement relationship is calculated dynamically using the engagement's scoring rule. The system collects every assessment sent on the TP element and keeps only the latest assessment for each questionnaire template, based on assessment close date. It then applies the engagement's risk-area criteria to that set. When more than one TP element shares the same classification for an engagement (for example, multiple TP elements classified as Product), component criteria are applied at the classification level. The resulting component score contributes to the engagement's overall risk score. Engagement and third-party risk-area calculations also include assessments sent on linked TP elements and assessments sent directly on the engagement or third party. If you link a TP element that already has assessment evidence to a new engagement, the relationship score is calculated automatically using the existing evidence. A new assessment on the TP element isn't required for each engagement it's linked to. Linking or unlinking a TP element and closing a TP element assessment each recalculate the affected engagement and third-party ratings in real time. Reassigning a third party's scoring rule triggers a full recalculation of that third party's score tree, including its engagements and elements. Note: The relationship score uses the target engagement's scoring rule and business service criticality, not the third party's scoring rule in the relationship score calculation. This means the same element can produce different risk ratings for different engagements. The calculation uses raw questionnaire and document request ratings from closed, valid element assessments (not assessment-level risk ratings). When multiple assessments use the same questionnaire template, only the latest assessment (by close date) is used; different templates in the same risk area both contribute. If no valid evidence exists for a relationship, the risk rating is cleared. The relationship score is stored in `sn_tprm_dd_m2m_engagement_element.risk_rating`. You can create your own TP element classifications to meet your specific risk program requirements. For more information on creating classifications and assigning weights for scoring, see [Third-party element form](https://www.servicenow.com/docs/9vsHitNSneqIWoCDUHIMSg "Use the third-party element form to capture the information needed to create a third-party element record in the Third-party Risk Management application. As a third-party risk manager, third-party risk assessor, or due diligence request owner, you can create a third-party element record.") and [Define component criteria](https://www.servicenow.com/docs/bTunYxWbBwZdDH_dl0yVuA "Components are the entities for which you can assess risk (for example, subsidiaries or engagements). A component criteria is a group of components that should apply to a particular type of third party or engagement.").