--- sourceDocument: Australia Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance Release : - australia ft:locale : - en-US ft:publication_title : - Australia Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Risk intelligence providers # Risk intelligence provider integrations {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Risk intelligence provider integrations The Third-party Risk Management (TPRM) application supports integrations with external risk intelligence providers to request and receive risk intelligence reports (RIR) and due diligence data for third parties. These integrations enable organizations to automate the submission, processing, and retrieval of risk scores and reports associated with third-party risk assessments. Show full answer Show less ## Integration Requirements and Process * Users with roles such as Third-party risk (TPR) assessor or TPR manager can initiate risk intelligence report requests via a request form. * Before requesting reports, a user with the TPR assessment reviewer role must register providers, configure provider services, and set up request types in the TPRM application. * The integration API manages RIR request workflows, including: * Detecting requests in the "Order pending" state via a nightly job. * Sending request data packets to risk intelligence providers, including identifiers for the request, provider, third party, and request type. * Updating request states to reflect progress: "Order in progress," "Closed complete," or "Closed incomplete" based on processing outcomes. * Receiving response packets containing report URLs, scores, ratings, and content, which are then stored and linked to the corresponding third-party records. * The integration creates risk intelligence score records and attaches report URLs to the related RIR request records. ## Risk Intelligence Report Request States * **Open:** Initial state after creation by authorized users. * **Order pending:** Request submitted to the provider; fields become read-only. * **Order in progress:** Provider has received the order; score records are generated. * **Closed complete:** Provider successfully processed and returned the report. * **Closed incomplete:** Provider could not process the order; request closed with errors. * **Canceled:** Request canceled by authorized users before processing; record becomes non-editable. ## Limitations * The integration API does not update existing score records; if a field is missing during creation, a new score record is created instead of updating. * Failed report transmissions result in the request state being marked "Closed incomplete," requiring manual follow-up. ## Implications for ServiceNow Customers This integration streamlines the risk intelligence report request lifecycle, reduces manual effort in managing third-party risk data, and ensures consistent tracking of report statuses. Customers can expect automated synchronization of risk scores and report URLs, enabling efficient review and management of third-party risks within the ServiceNow platform. The Third-party Risk Management application includes support for risk intelligence provider integrations. These guidelines can help your organization to develop a risk intelligence provider integration for Risk intelligence report (RIR) requests for third parties and due diligence requests. ## Integration requirements {#tprm-integrate-rir__section_uzw_2b5_wbc} The TPRM application enables your organization to integrate with external risk intelligence content providers. If you have the Third-party risk (TPR) assessor \[sn_vdr_risk_asmt.vendor_risk_assessor\] or TPR manager \[sn_vdr_risk_asmt.vendor_risk_manager\] role, you can request the scores or reports for third parties by using the risk intelligence request form. After the reports are generated by the provider, the links to the reports are uploaded to the Third-party Risk Management application and associated with the relevant third party. Note: Before requesting reports and scores, a team member with the TPR assessment reviewer \[sn_vdr_risk_asmt.vendor_assessment_reviewer\] role must register the providers and set up both the providers and request types in the Third-party Risk Management application. For more information, see [Register a risk intelligence provider](https://www.servicenow.com/docs/PoreWgmHfc1unv6j5xUMxA "Create a record for each risk intelligence provider from which you’ll request reports. The risk scores and ratings that risk intelligence providers generate are analogous to personal credit scores. The scores provide insight on how trustworthy and safe a particular third party can be."), [Set up a risk intelligence provider service](https://www.servicenow.com/docs/sxSJm02LQi7NqqaM0D0b4w "After you register a risk intelligence provider, you specify which of the provider's scoring or rating services you’ll use. You also specify how their scores or ratings map to your TPRM ratings."), and [Set up a request type for a provider](https://www.servicenow.com/docs/NNGNoIcJD4Ay_yuzmkgYKA "After you register a risk intelligence provider and service, you specify the available request types that you and your organization will use."). The following diagram shows the RIR request flow states and their relationship with the integration requirements for risk intelligence providers. Figure 1. RIR requests integration Integration process: 1. All RIR requests in the Order pending state are ready to be sent to the risk intelligence provider. 2. A nightly job is set up by the integration API to check for the report request records that are in the Order pending state. 3. The integration API updates the RIR request record state to Order in progress, 4. The integration API sends a packet to the provider that includes the names of the records and their corresponding source tables: * rir_sysid \[sn_tprm_dd_risk_intel_request\] * provider_sysid \[sn_vdr_risk_asmt_tpss_provider_basic\] * third_party_sysid \[core_company\] * third_party_name \[core_company\] * request_type_sysid \[sn_tprm_dd_risk_intel_request_type\] * request_type_name \[sn_tprm_dd_risk_intel_request_type\] * provider_service_sysid \[sn_vdr_risk_asmt_tpss_provider\] {#tprm-integrate-rir__ol_sfh_y3c_ccc} 5. If the packet isn't sent successfully, the integration API updates the RIR request state to Closed incomplete. 6. After receiving the RIR request, the risk intelligence provider processes it and gathers information including the URL, score, and content. 7. The risk intelligence provider returns a packet for upload to the Third-party Risk Management application. The packet contains the following names of the records, their corresponding source tables, and content: * rir_sysid \[sn_tprm_dd_risk_intel_request\] * provider_sysid \[sn_vdr_risk_asmt_tpss_provider_basic\] * third_party_sysid \[core_company\] * request_type_sysid \[sn_tprm_dd_risk_intel_request_type\] * provider_service_sysid \[sn_vdr_risk_asmt_tpss_provider\] * URL * score * rating * content {#tprm-integrate-rir__ol_cvv_njc_ccc} Note: The score or rating should be the provider's score or rating. The provider should have set up a mapping to convert the provider's score to a ServiceNow score through a Provider Service record. 8. Using the packet information, the integration API creates a risk intelligence score record \[sn_vdr_risk_asmt_security_score\] and populates the URL field. This URL is used to download and attach the reports to the associated RIR request record \[sn_tprm_dd_risk_intel_request\]. 9. The integration API updates the state of the RIR request from Order in progress to Closed complete or Closed incomplete, depending on whether the risk intelligence provider completes the report or fails to send it and decides to close the order. {#tprm-integrate-rir__ol_vxm_xfn_wbc} ## Limitations {#tprm-integrate-rir__section_ubj_kyn_zbc} The integration API doesn't update the score record in the Score table. If the API fails to populate a field when it creates a score record, a new score record is created instead of updating the existing record. For example, if the API didn't associate a score with an RIR request, it has to call the API again to create a new score and associate it with the RIR request. ## Risk intelligence report request states {#tprm-integrate-rir__section_zdm_cx1_cbc} The risk intelligence report requests have the following potential states: Open : An RIR request enters this state after the record has been created and saved by the Third-party Risk (TPR) manager, TPR assessor, or contract negotiator that is assigned to the due diligence request. For each risk intelligence request, the system auto-assigns a unique ID number that starts with the text RIR. Order pending : An RIR request enters this state after the record has been submitted by the Third-party Risk (TPR) manager, TPR assessor, or contract negotiator that is assigned to the due diligence request.The following changes take place: * The order has been submitted to the provider. * The Request date field has been populated with the date that this record was submitted on. * All fields in the Risk intelligence report request section are read-only. {#tprm-integrate-rir__ul_gg5_hss_3bc} Order in progress : An RIR request enters this state after the order has been received by the provider. The following changes take place: * The score records are generated with the report request. * The Score generated on field is updated. {#tprm-integrate-rir__ul_mwx_lss_3bc} Closed incomplete : An RIR request enters this state after the order was received by the provider but couldn't be processed due to an error so the order was closed. Closed complete : An RIR request enters this state after the order was received and processed by the provider. Canceled : An RIR request enters this state after a TPR manager, TPR assessor, or contract negotiator cancels the report request. If a TPR manager, TPR assessor, or contract negotiator must cancel a request, it can be done while the request is in the Open or Order pending state. After an RIR request is canceled, that record can't be edited. You must create a record.