---
sourceDocument: Australia Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Use risk intelligence reports and scores

# Using risk intelligence reports and scores {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Using risk intelligence reports and scores

The Third-party Risk Management (TPRM) application in ServiceNow enables you to request and manage risk intelligence reports and scores directly from external risk intelligence providers.
These providers analyze various third-party risk domains, offering insights similar to credit scoring systems that help assess third-party risks such as geopolitical, economic, compliance, and strategic factors.
This capability supports informed decision-making throughout your third-party risk management program.
Show full answer Show less  

## Setting Up Providers and Request Types

Before requesting reports, users with the TPR assessment reviewer role must register risk intelligence providers and configure request types within the TPR application. This setup ensures that different report types (e.g., credit, compliance, strategic risk) can be requested according to your organization's agreements with providers. Note that reports can only be requested for third parties, not for engagements.

## Requesting Risk Intelligence Reports and Scores

* Users with roles such as TPR manager, TPR assessor (due diligence request owner), or contract negotiator assigned to a due diligence request can initiate a Risk Intelligence Report (RIR) or score request.
* Requests must be submitted via the RIR request form and can be linked either to a third party or a due diligence request. Associating with a due diligence request enhances visibility for reviewers and approvers.
* For association with a due diligence request, the inherent risk questionnaire (IRQ) must be completed, and the request must be in IRQ in progress state.
* Once submitted and in Order pending state, request details become read-only to prevent errors.
* Requests can be canceled in Open or Order pending states if no longer needed or if new information arises.
* After provider processing, report links and scores are linked to the RIR record, moving the request to Closed complete state.
* The platform submits requests but does not validate provider-specific prerequisites; providers decide whether to fulfill requests.
* Duplicate requests for the same provider, request type, and third party are prevented to avoid multiple orders.
* You can manually add risk intelligence scores to third parties and review existing scores within the related list.

## Tracking Sanctions-Related Information

The application supports logging and updating sanctions-related information on third parties, helping your team monitor involvement in prohibited or restricted activities under government sanctions or regulations. This information is crucial during due diligence reviews and approvals as part of your third-party risk program.  
Request risk intelligence reports or scores directly from your external risk intelligence content providers by using the Third-party Risk Management application. This information can be requested and managed based on the importance or risk level of the individual third party.

## Risk intelligence overview {#tprm-riskintel-using__section_zhk_15s_m1c}

Risk intelligence providers are companies that specialize in analyzing and generating risk scores for various third-party risk domains. These providers offer services that are similar to personal credit scoring
systems, delivering data that helps organizations assess third parties.

If you have the third-party risk (TPR) assessor \[sn_vdr_risk_asmt.vendor_risk_assessor\] and are the due diligence request owner or the TPR manager \[sn_vdr_risk_asmt.vendor_risk_manager\] role, you can use the TPRM application to request scores or reports for third parties by using the risk intelligence request form. After the reports and scores are generated by the risk intelligence
provider, the links to these reports are delivered and associated with that risk intelligence report record.

The information in these reports can cover various topics, including the geopolitical risks, economic stability, industry-specific trends, and regulatory changes that could affect your third-party interaction. You can order
different types of reports, such as credit risk reports, compliance reports, strategic risk reports, and more, for your specific risk management program requirements.

The Risk Intelligence Report framework provides a common way to request reports, but it does not enforce provider‑specific requirements. Each risk intelligence provider decides whether a request can be fulfilled based on its
own integration and the your organization's agreement with that provider. A report is returned only if the provider's requirements are met.

## Setting up risk intelligence providers and request types {#tprm-riskintel-using__section_tq1_nzc_yxb}

If you have the TPR assessment reviewer \[sn_vdr_risk_asmt.vendor_assessment_reviewer\] role, you must register the providers and set up both the providers and request types in the Third-party Risk Management application before you can request a report. For more information, see [Register a risk intelligence provider](https://www.servicenow.com/docs/PoreWgmHfc1unv6j5xUMxA "Create a record for each risk intelligence provider from which you’ll request reports. The risk scores and ratings that risk intelligence providers generate are analogous to personal credit scores. The scores provide insight on how trustworthy and safe a particular third party can be."), [Set up a risk intelligence provider service](https://www.servicenow.com/docs/sxSJm02LQi7NqqaM0D0b4w "After you register a risk intelligence provider, you specify which of the provider's scoring or rating services you’ll use. You also specify how their scores or ratings map to your TPRM ratings."), and [Set up a request type for a provider](https://www.servicenow.com/docs/NNGNoIcJD4Ay_yuzmkgYKA "After you register a risk intelligence provider and service, you specify the available request types that you and your organization will use.").  
Note:  
You can request risk reports for third parties but not for engagements.

## Requesting risk intelligence {#tprm-riskintel-using__section_q3x_15s_m1c}

As a TPR manager \[sn_vdr_risk_asmt.vendor_risk_manager\], TPR assessor \[sn_vdr_risk_asmt.vendor_risk_assessor\] that is the due diligence request owner, or contract negotiator \[sn_vdr_risk_asmt.contract_negotiator\] that is
assigned to the due diligence request, you can request a Risk Intelligence Report (RIR) or score to gain insight on how trustworthy a particular third party can be. You would follow this process to request risk intelligence
reports or scores:

1. Fill out the RIR request form. An RIR request can be associated with a third party or due diligence request. When you associate a RIR request with a due diligence request, reviewers and approvers can more easily access all the related activity, scores, reports, and details through the Risk Intelligence report request tab in the Vendor Management Workspace\[var.vendor-management-ws\]. For more information, see [Request a risk intelligence report](https://www.servicenow.com/docs/J0eVmrpV21bcE0yAjQWAjw "Request a risk intelligence report (RIR) or score to gain insight on how trustworthy a particular third party can be using the Third-party Risk Management application.") and [Request a risk intelligence report associated with a due diligence request](https://www.servicenow.com/docs/o7HEaj4GKQe3iIUybVSUUw "Request a risk intelligence report (RIR) or score to gain insight on how trustworthy a particular third party can be as part of the due diligence request process by using the Third-party Risk Management application. By associating your RIR request with a due diligence request, all activity, scores, reports, and details are available for you to see.").  
   Note:  
   If you want to associate an RIR request with a due diligence request, it must be after the inherent risk questionnaire (IRQ) has been completed (that is, when the due diligence request has entered the IRQ in progress state).
2. The TPR manager \[sn_vdr_risk_asmt.vendor_risk_manager\] and their team reviews the request.
3. The TPR manager \[sn_vdr_risk_asmt.vendor_risk_manager\], TPR assessor \[sn_vdr_risk_asmt.vendor_risk_assessor\] that is the due diligence request owner, or contract negotiator \[sn_vdr_risk_asmt.contract_negotiator\] that is assigned to the due diligence request can submit it if it's approved. After the request has been submitted and has entered the Order pending state, all fields in the Risk intelligence report request section are read-only to help to prevent incorrect orders from being submitted to the provider.  
   Note:  
   The TPR manager, TPR assessor, or contract negotiator can cancel a RIR request while the request is in the Open or Order pending state. An RIR request can also be canceled if the report is no longer needed due to new information that impacts the third party or some other change.
4. After the reports and scores are generated by the risk intelligence provider, the links to these reports and the scores are delivered and associated with the risk intelligence report request. The RIR request then enters the Closed complete state.

{#tprm-riskintel-using__ol_nlq_sfm_bcc}

After a request is submitted, the risk intelligence provider determines whether the request can be fulfilled based on its own requirements. The platform submits the request and records the outcome, but does not validate
provider-specific prerequisites.

For more information on RIR requests and their process states, see [Risk intelligence report requests management](https://www.servicenow.com/docs/9EfKZUCB1AuLMvmQCndClg "You can view a list of risk intelligence report (RIR) requests, their associated providers, scores, and report URLs. In addition, you can create requests and make updates by using the Third-party Risk Management application.").  
Note:  
You can't have multiple RIR requests with the same provider, request type, or third party. For example, if you have already associated an RIR request with a third party, you can't request the same report from the same provider as part of a due diligence request for an engagement. This process helps with preventing duplicate orders from being submitted to the provider.

You can manually add scores to third parties and use the Risk intelligence scores related list to review the background information on the existing scores for a third party. For more information, see [Add a risk intelligence score to risk data for a third party](https://www.servicenow.com/docs/NhS7YKe29kmpHbuOkYaSSw "You add a raw score from a provider to the provider service record for a third party. The system uses the mapping that you specified to normalize the value to the appropriate TPRM rating.").

## Tracking sanctions-related information {#tprm-riskintel-using__section_gtt_x45_51c}

By tracking sanction-related information about your third parties, you can check if that third party is involved in any activities that are prohibited or restricted by government sanctions or regulations. Logging and updating
sanctions-related information for third parties keeps your team informed as you review and approve a due diligence request as part of your third-party risk program. For more information about tracking sanctions-related
information, see [Track sanctions-related information](https://www.servicenow.com/docs/kYd80sRZFWT1~EReDjsukw "Track sanction-related information as part of requesting risk intelligence reports and scores by using the Third-party Risk Management application. Logging and updating sanctions-related information for third parties keeps your team informed as you conduct due diligence as part of your third-party risk program.").