---
sourceDocument: Australia Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# External assessment lifecycle states

# External assessment lifecycle states {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of External assessment lifecycle states

This content explains the lifecycle states involved in managing external assessments within the ServiceNow Third-Party Risk (TPR) framework.
It details the progression of an external assessment record as it moves from creation to closure, including how questionnaires and document requests are handled by third parties and internal teams.
Show full answer Show less  

## External Assessment Lifecycle States

* **Draft:** An assessment record is created. Assessment templates and risk ratings are auto-generated or manually specified. An owner with the TPR manager or assessor role is assigned to manage and monitor the assessment.
* **Submitted to third party:** Questionnaires and document requests are sent to the third-party contact, awaiting their responses.
* **Responses received:** The third party completes the questionnaires and document requests. Internal teams review the responses and may request follow-ups or clarifications.
* **Generating observations:** The system can auto-generate issues based on incorrect answers. The third party addresses these issues, and internal teams decide whether to accept or require remediation.
* **Finalizing with a third party:** Internal teams review all data. If needed, assessments can be reset to Draft to restart the lifecycle.
* **Closed:** Once all data is acceptable, the assessment is closed, potentially triggering contract risk processing. Contracting only begins after questionnaire approval and assessment closure.

## Questionnaire States

Questionnaires have distinct state models depending on the engine used:

### Classic Engine

* **Questionnaire requests:** Track sending and completion status with states like Ready to take, In progress, Complete, and Canceled.
* **Questionnaires themselves:** More granular states including New, Submitted, In Progress, Received, Returned, and Canceled, managing the workflow of questionnaire completion and review.

### Smart Assessment Engine (SAE)

* Uses a simplified set of questionnaire states: In progress, Completed, and Canceled.
* If customers upgraded from older versions and enabled SAE, questionnaire workflows are streamlined accordingly.

## Practical Implications for ServiceNow Customers

* Understanding these lifecycle states helps customers monitor and manage third-party assessments efficiently.
* Assigning the correct owner roles ensures proper oversight and timely completion.
* Using the system's auto-generation of issues and streamlined questionnaire states can accelerate assessment workflows.
* Recognizing when assessments can be reset or closed supports better control over third-party risk management and contract initiation.  
The process of collecting assessment data from a third party moves through several states. For example, during the Submitted to third party state, the third party responds to tasks, issues, and works to complete the questionnaires.{#tprm-external-assessment-lifecycle__ph-shortdesc-tprm-external-assessment-lifecycle}

## Third-party assessment states {#tprm-external-assessment-lifecycle__section_ltq_5mf_1lb}

Figure 1. Third-party assessment states

Draft
:   An external assessment record is opened in the Draft state.

    * Assessment template: A set of external questionnaires and document requests that are auto-generated based on IRQ responses. Alternatively, an administrator could manually specify the questionnaires and document requests.
    * Risk rating: The overall risk rating that is auto-generated based on IRQ responses.
    * Owner: The owner is the person who owns an assessment for audit purposes and monitors and manages overall assessment processes. Owners are responsible for confirming that the assessment is completed in a timely fashion by the third party, reviewing their responses, and creating and resolving issues. To drive the assessment to its completion, owners are notified when an assessment reaches a particular milestone. The owner must have the TPR manager or TPR assessor role.
    {#tprm-external-assessment-lifecycle__ul_hh4_dpf_1lb}

Submitted to third party
:   The questionnaires and document requests for the assessment have been sent to the third-party contact. Internal stakeholders await responses.

Responses received
:   After contacts at the third party have completed all questionnaires and document requests, your internal third-party risk team reviews and analyzes the responses. The team might return particular questions for follow-up,
    clarification, or missing answers.

Generating observations

:   When all responses are completed, the system can auto-generate issues for incorrect answers. Third-party contacts respond to issues. Your internal third-party risk team makes a final determination to accept the responses or
    remediate the issues.

Finalizing with a third party
:   Your third-party risk team reviews all assessment data. In some cases, the team resets the assessment to the Draft state to restart the assessment life cycle.

Closed
: When all data is acceptable, the assessment is complete and a member of the team closes the assessment. If the engagement will be contracted, the Closed state initiates the contract risk process.  
Note:  
After the questionnaire is completed and approved, the assessment can proceed to the next stage of onboarding or contracting. The contract process does not begin until the approval process is complete.

## Questionnaire states {#tprm-external-assessment-lifecycle__section_hbb_fdm_tjc}

In the Classic engine, questionnaire requests (previously called assessment instances) and questionnaires themselves have separate state systems. The SAE uses a simplified set of questionnaire states.  
Note:  
If you upgraded from Yokohama or earlier and enabled the Smart Assessment Engine (SAE) in Zurich, questionnaire states are simplified to the three states shown above.

Questionnaire requests track the overall status of a questionnaire request sent to a third party.
{#tprm-external-assessment-lifecycle__table_classic_questionnaire_request_states__entry__2}

| Questionnaire request state | Description |
|-|-|
| Ready to take | Questionnaire request is prepared and ready to be sent to the third party. |
| In progress | Questionnaire request has been sent to the third party and is being completed. |
| Complete | Questionnaire request is complete and the third party has submitted their response. |
| Canceled | Questionnaire request is canceled and is no longer active. |
[Table 1. Classic engine questionnaire request states]

{#tprm-external-assessment-lifecycle__table_classic_questionnaire_request_states}

Questionnaires themselves move through additional states that track the workflow of completing and reviewing the questionnaire content.
{#tprm-external-assessment-lifecycle__table_classic_questionnaire_states__entry__2}

| Questionnaire state | Description |
|-|-|
| New | Questionnaire is created but not yet sent to the third party. |
| Submitted | Questionnaire is sent to the third party for completion. |
| In Progress | Third party is actively working on the questionnaire. |
| Received | Third party submits the completed questionnaire for review. |
| Returned | Questionnaire is sent back to the third party for updates and corrections. |
| Canceled | Questionnaire is canceled and is no longer active. |
[Table 2. Classic engine questionnaire states]

{#tprm-external-assessment-lifecycle__table_classic_questionnaire_states} {#tprm-external-assessment-lifecycle__table_sae_questionnaire_states__entry__2}

| Questionnaire state | Description |
|-|-|
| In progress | Questionnaire is active and being completed by the third party. |
| Completed | Questionnaire is finished and submitted. |
| Canceled | Questionnaire is canceled before completion. |
[Table 3. SAE questionnaire states]

{#tprm-external-assessment-lifecycle__table_sae_questionnaire_states}