---
sourceDocument: Australia Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# IRQ process management

# IRQ process management {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of IRQ Process Management

The IRQ process is initiated immediately after an engagement request is approved to evaluate and scope the third party's risk by determining its risk score.
This process is accessed and managed within the Due Diligence Management module on the Internal Assessments tab, where each IRQ process is uniquely identified and tracked throughout its lifecycle.
Show full answer Show less  

## Accessing and Managing IRQ Processes

ServiceNow customers can navigate to the Due Diligence Management page, select a Due Diligence Request (DDR) number, and then open the Internal Assessments tab to view all IRQ processes related to that engagement. Each IRQ process is assigned a unique identifier starting with "INA" which can be used for searching, filtering, and referencing.

The Internal Assessments tab displays key information such as:

* **Number:** Unique IRQ ID (INA number)
* **Name, Assigned to, Risk rating:** Details carried over from the engagement request
* **State:** Current status (Draft, Awaiting response, Response received, Closed)
* **Respondents:** Users who have responded to the request

## Internal Assessments Page and Tabs

By selecting an INA number, users can access the Internal Assessments page, which provides several tabs to manage and monitor the IRQ process effectively:

* **Risk Overview Tab:** Displays the status of each stage in the IRQ process, lists associated questionnaires, and tracks assessment counts categorized as Open, Overdue, or Closed.
* **Details Tab:** Contains general third-party information, assessment and questionnaire due dates, and sections to add internal work notes (private) or comments visible to both internal users and third-party contacts. It also records activities such as issue tracking, task updates, and communication logs.
* **Questionnaire Templates Tab:** Lists all open IRQ questionnaires, allowing users to review questionnaire details.
* **Scales Tab:** Defines rating and tier values used for risk scoring, helping standardize how risk levels are calculated.
* **Questionnaire Requests Tab:** Shows all questionnaire instances generated for the assessment, each with unique IDs (AINST for assessment instances, VRA for external risk assessments). It includes information such as assigned users, due dates, current state, and internal risk scores.

## Risk Scoring and Assessment Creation

Engagement scoring rules specify criteria to automatically select engagements for risk assessment, such as those exceeding a defined business value threshold. These rules apply only to engagements and help prioritize risk evaluations.

ServiceNow users can create new internal assessment forms to capture all necessary information and can also develop assessment templates tailored to their third-party risk assessment needs.

## Practical Benefits for ServiceNow Customers

* Streamlines the internal risk assessment process immediately after engagement approval.
* Provides unique identifiers for efficient tracking and management of IRQ processes.
* Enables detailed monitoring of risk stages, questionnaire responses, and due dates.
* Facilitates communication and documentation through private and shared notes and comments.
* Standardizes risk scoring through defined rating scales and engagement scoring rules.
* Supports creation and reuse of assessment templates for consistent evaluations.  
The first internal step after an engagement request is approved is to start the IRQ process to scope the risk by determining the third party's risk score.

## Accessing the IRQ process {#tprm-ws-dd-mgt-pg-irq-tab__section_cc2_kvg_cyb}

On the Due diligence management page, select the DDR number for any due diligence request and then select the Internal assessments tab.

The tab displays the list of all IRQ processes for the engagement request. For each IRQ process, the system auto-assigns a unique ID number that starts with the text INA.

## Viewing the list of internal risk assessments {#tprm-ws-dd-mgt-pg-irq-tab__section_k2k_3vt_2yb}

Internal assessments tab
:   {#tprm-ws-dd-mgt-pg-irq-tab__table_drw_dbj_fyb__entry__2}

    | Column | Description |
    |-|-|
    | Number | For each IRQ process, the system auto-assigns a unique ID number that starts with the text INA. Select an INA number to work on the Internal assessments page to the Risk overview tab. The unique ID is used in all references to the item. You can use the ID to search or filter for the item that you want to work on. |
    | Name, Assigned to, Risk rating | Data from the engagement request. |
    | State | The current state of the internal assessment: Draft, Awaiting response, Response received, or Closed. |
    | Respondents | Users who responded to the request. |
    [Table 1. Internal assessments tab]

    {#tprm-ws-dd-mgt-pg-irq-tab__table_drw_dbj_fyb}

Risk overview tab on the Internal assessments page

:   For each IRQ process, the system auto-assigns a unique ID number that starts with the text INA. Select an INA number to work on the IRQ process on the Internal assessments page.

    * The symbols indicate the state of each stage in the IRQ process for the request.

    * Questionnaire requests section: List of questionnaires that are associated with the third party. You can view each questionnaire by selecting the Name.
    * Tracking section: Count of assessments associated with the third party that are in the Open, Overdue, and Closed state.
    {#tprm-ws-dd-mgt-pg-irq-tab__ul_xxl_opj_fyb}

Details tab on the Internal assessments page
:
    * Internal assessment section: General information on the third party and schedules for the overall assessment and questionnaire due dates from the engagement due diligence request.
    * The Compose section on the Details tab enables you to permanently add text to the record. The Activity section is updated with any actions on issues and tasks, submissions to TP contacts, and also with work notes and comments that users add to the record. Add text in the following fields as needed:
      * Work notes (Private): Information about the third-party risk assessment. Work notes are visible only to internal users who are assigned to the process.
      * Comments: Comments about the third-party risk assessment are visible both to internal users and to third-party contacts.
      {#tprm-ws-dd-mgt-pg-irq-tab__ul_g1d_3kn_cqb}
    * The Third-party overview section provides key information on the third party that is associated with the engagement request.
    {#tprm-ws-dd-mgt-pg-irq-tab__ul_exr_x2n_2yb}

Questionnaire templates tab on the Internal assessments page
:   The tab lists all open IRQs. Select a questionnaire name to view the details.

Scales tab on the Internal assessments page
:   The tab lists the definitions of the calculated rating and tier values. See [Set up risk rating scales for scoring](https://www.servicenow.com/docs/rWk79zC~4SwwIybHPumZhA "The risk rating scale helps business users better understand risk assessment results. For example, in the default settings, risk scores in the 20 through 39 range indicate high risk, while scores in the 60 through 79 range indicate low risk.") for instructions for defining the settings.

Questionnaire requests tab on the Internal assessments page

:   All values on the tab come from the internal assessments that have been conducted on the third part in the engagement.

    {#tprm-ws-dd-mgt-pg-irq-tab__table_fyw_dwj_fyb__entry__2}

    | Column | Description |
    |-|-|
    | Number | When a questionnaire template is added to an assessment and sent out, the system generates assessment instances for each template. Each of these instances is automatically assigned a unique ID number that starts with the text AINST. The unique ID is used in all references to the item. You can use the ID to search or filter for the item that you want to work on. |
    | Assessment number | For each external risk assessment, the system auto-assigns a unique ID number that starts with the text VRA. The unique ID is used in all references to the item. You can use the ID to search or filter for the item that you want to work on. |
    | Metric type | Questionnaire that determined the questionnaires used in the assessment. |
    | Assigned to | User that is responsible for managing and responding to the IRQ. |
    | Due date | Deadline for third party to respond to and return all questionnaires. |
    | State | Current stage of the IRQ process for the engagement request. |
    | Internal risk score | An engagement risk-scoring rule specifies component criteria that determine which engagements are selected for assessment. For example, a rule could enable assessments for engagements that involve more than $40,000 annual business. Engagement scoring rules apply only to engagements. See [Define engagement risk scoring rules](https://www.servicenow.com/docs/E~dY6oWW8Bkz~1A1~jECSw "An engagement risk-scoring rule specifies component criteria that determine which engagements are selected for assessment. For example, a rule could enable assessments for engagements that involve more than $40,000 annual business. Engagement scoring rules apply only to engagements."). |
    [Table 2. Questionnaire requests tab]

    {#tprm-ws-dd-mgt-pg-irq-tab__table_fyw_dwj_fyb}
* **[Create new internal assessment form](https://www.servicenow.com/docs/Jby1IB6TJXOU2YF2S_urBg)**   
  Use the internal assessment form to capture all the information that you need to create an internal assessment. As a third-party risk assessor, you can create an assessment template.

**Related concepts**   

* [Assessing your third-party risk](https://www.servicenow.com/docs/HhMe7LKkoxctYhTzh0d5Aw "Use Third-party Risk Management to identify and assess potential risks that are associated with your third-party relationships. The information gathered from internal questionnaires, external questionnaires, and documentation requests helps you to understand the third party's risk profile, determine the appropriate risk mitigation strategies, and determine whether the third party or engagement meets all necessary compliance requirements.")  
**Related tasks**   

* [Respond to an internal assessment](https://www.servicenow.com/docs/NIHRKblHkO53M6nXO~yAQQ "Respond to an Inherent Risk Questionnaire (IRQ) or internal assessment that has been assigned to your queue. Your responses to the questionnaire help determine if the process moves forward and can affect which questionnaires are sent to the third party or engagement.")