---
sourceDocument: Australia Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Reasons for multiple engagements with one third party

# Why you might have several engagements with a single third party {#ariaid-title1}

Release version: Australia  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Why you might have several engagements with a single third party

When onboarding a third party, you may have multiple distinct engagements with them, each representing a different type of relationship or service provided.
Each engagement requires its own risk assessment because the nature of services, access levels, and potential impacts on your organization vary.
This approach enables tailored risk management strategies specific to each engagement.
Show full answer Show less  

## Key considerations for multiple engagements

* **Separate risk assessments:** Different engagements with the same third party can have varying risk profiles, necessitating unique assessments to identify and mitigate risks effectively.
* **Engagement states:** An engagement starts as inactive and becomes active once a contract is in place or an active relationship begins.
* **IRQ process:** After engagement approval, the Internal Risk Questionnaire (IRQ) process is initiated to determine the third party's risk score and scope the risk appropriately.

## Example: Distinct services with varying risk profiles

Your organization might contract a single third party for two very different services, such as:

* **Software Development Engagement:** Involves the third party developing custom software that accesses sensitive customer data, integrates with critical systems, and affects infrastructure. This engagement carries a higher risk and requires strict data protection, system integration controls, thorough testing, and rigorous change management.
* **Facilities Management Engagement:** Focuses on physical security and building maintenance, including access control and safety. While important, this engagement typically involves lower and more manageable risks compared to software development.

## Benefits for ServiceNow customers

Understanding why multiple engagements exist helps you apply risk management processes correctly within ServiceNow's third-party risk management framework. By managing engagements separately, you ensure that risk assessments are precise and controls are appropriate for each service type, enhancing your organization's overall security and compliance posture.  
While onboarding a particular third party, you might conduct a separate engagement for each distinct type of relationship that you have with the third party. One engagement is to assess the risk involved in the third party's development of software for your organization and a separate engagement is for the facilities management service that they provide.

## Different engagements of the same third party might require varying levels of risk assessment {#vrm-diffs-btw-thirdpty-and-engmnts__section_v5l_tnd_5xb}

Note:  
The first internal step after an engagement request is approved is to start the IRQ process to scope the risk by determining the third party's risk score. An engagement starts in the inactive state. An engagement moves to the active state when a contract is in place or you take part in an active relationship with the third party.

Different engagements of the same third party can require different levels of risk assessment due to variations in the nature of the services provided, the level of access to sensitive data or critical systems, and the potential
impact on your organization's infrastructure. By conducting a separate risk assessment for each engagement, you can tailor your risk management strategies and controls to address the risks associated with each engagement
effectively.

## Example --- the third party will provide two distinct services {#vrm-diffs-btw-thirdpty-and-engmnts__section_vlg_3hx_txb}

In this example, Your organization engages with a third party for two distinct services:

Service: Software Development Engagement
:   The third party is responsible for developing a custom software application for the financial institution. This engagement involves the third party accessing and processing sensitive customer data, integrating with critical
    systems, and potentially introducing changes to the organization's infrastructure.

Service: Facilities Management
:   The third party is also responsible for managing the physical security and maintenance of the financial institution's office buildings. This engagement involves providing security personnel, managing access control systems,
and confirming the overall safety and maintenance of the facilities.  
The services present different risk profiles and require separate risk assessment engagements:

Engagement for the software development service

:   This engagement involves a higher level of risk due to the following factors:

    * Access to sensitive data: The third party has access to customer data, which requires strict data protection and privacy controls to help prevent unauthorized access or data breaches.
    * System integration: The third party's software must integrate with critical systems, potentially impacting the stability, availability, or security of those systems. Proper testing and quality assurance procedures are crucial to minimize the risk of system failures or vulnerabilities.
    * Change management: The introduction of new software or changes to existing systems can introduce risks, such as compatibility issues, system disruptions, or software vulnerabilities. Robust change management practices and code review processes are necessary to mitigate these risks.
    {#vrm-diffs-btw-thirdpty-and-engmnts__ul_frw_j3x_txb}

Engagement for the facilities management service

:   Even though this engagement also involves the same third party, the risk profile is lower when compared to the software development engagement:

    * Physical security: The focus here is on managing physical security measures, such as access control and surveillance systems. While still important, the risks associated with physical security are typically more straightforward and easier to manage compared to cybersecurity risks.
    * Maintenance and safety: The third party's responsibility is primarily related to general maintenance and promoting a safe working environment. While there are still risks associated with building maintenance (for example, safety hazards), they might be more predictable and manageable compared to the complex cybersecurity risks in the software development engagement.
    {#vrm-diffs-btw-thirdpty-and-engmnts__ul_nnm_s3x_txb}