---
sourceDocument: Brazil Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/governance-risk-compliance
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Governance, Risk, and Compliance
ft:clusterId :
- grc
bundleId :
- grc
workflow :
- Technology
---
# Assess third-party risk
# Assessing your third-party risk {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 11 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Assessing your third-party risk
ServiceNow's Third-party Risk Management (TPRM) enables organizations to identify, assess, and mitigate risks associated with third-party relationships.
By leveraging internal and external questionnaires, documentation requests, and risk assessments, TPRM helps you understand a third party's risk profile, ensure compliance with regulations, and apply appropriate risk mitigation strategies to safeguard your enterprise.
Show full answer Show less
## Responding to Questionnaires
The inherent risk questionnaire (IRQ) process begins after a due diligence request is approved by a TPR manager or assessor who assigns an IRQ to an internal assessment. An assigned IRQ assessor completes the questionnaire, after which the TPR manager reviews and closes it. Important best practices include duplicating questionnaire templates rather than editing them after sending, ensuring consistent version control.
## Third-party Element Collection
Optional in your due diligence process, TP element collection gathers specific data elements related to third parties or engagements. This can involve assigning tasks to internal or third-party contacts to add or edit elements, especially when AI assets are involved. Element-level assessments can be initiated for elements flagged as requiring evaluation, enhancing granularity in risk assessments.
## Due Diligence and Compliance Verification
Following IRQ and element collection, TPR managers attach questionnaires and documentation requests to external assessments sent to third parties. The system notifies relevant third-party contacts to respond via the third-party portal. The process supports inclusion of software bill of materials (SBOM) questionnaires where applicable and enforces best practices for questionnaire version management.
Review of third-party responses focuses on verifying compliance with laws, regulations, and internal policies, including data security and privacy measures. If issues arise, tasks or remediation actions are created to ensure concerns are addressed. TPR managers can use assessment templates to automate and standardize questionnaire distribution for similar third parties.
## Pre-populating Questionnaires
To expedite assessments, questionnaires can be pre-populated with responses from previous completed questionnaires associated with the same third party. This feature reduces respondent effort by enabling review and update rather than full re-entry. Certain question types (e.g., attachments, signatures) are excluded from pre-population, and once sent, pre-population settings cannot be changed.
## Managing Issues and Tasks
TPR assessors, managers, and contract negotiators can create and manage tasks and issues to track concerns arising from questionnaire responses or documentation. Internal tasks support follow-up work within the organization and are not visible to third parties. AI capabilities assist in generating issue summaries and recommendations, enhancing efficiency in risk management workflows.
## Additional Assessment Actions
Assessments may be reopened to collect new or updated information or canceled if an assessment is no longer required. Reopening allows sending additional questionnaires or document requests, while cancellation does not halt the overall due diligence approval process. These options provide flexibility in managing dynamic third-party engagements.
Use Third-party Risk Management to identify and assess potential risks that are associated with your third-party relationships. The information gathered from internal questionnaires, external questionnaires, and documentation requests helps you to understand the third party's risk profile, determine the appropriate risk mitigation strategies, and determine whether the third party or engagement meets all necessary compliance requirements.
## Responding to questionnaires {#tprm-assessing-tpr__section_gg3_dys_pzb}
The following processes outline the timing and methods for responding to internal and external questionnaires:
Inherent Risk Questionnaire (IRQ) process
: The following infographic shows the IRQ process.
:
The following are the steps of the IRQ process.
1. After the due diligence request is approved by the Third-party risk (TPR) manager \[sn_vdr_risk_asmt.vendor_risk_manager\] or TPR assessor \[sn_vdr_risk_asmt.vendor_assessor\] that has been assigned as the owner of the due diligence request, they select an IRQ and attach it to an internal assessment.
2. The system sends out an email notification to the employee that has been assigned as the IRQ assessor \[snc_internal\].
3. The IRQ assessor completes the internal assessment by responding to the IRQ.
4. After the IRQ assessor submits their responses and the TPR manager or owner reviews and closes the IRQ, the due diligence request state updates from IRQ in progress to IRQ in review.
Note:
Don't change a questionnaire template after it has been sent out as part of an internal assessment. Instead, duplicate the template by making a copy and make your changes in the new copy. If you update a questionnaire after it has been sent out, the changes won't appear in the version shown to the IRQ assessor. To send an updated version, you must cancel the existing questionnaire by deassociating it from the internal assessment and then add the questionnaire using the updated template. For more information, see [Create a questionnaire or document request template](https://www.servicenow.com/docs/SS6tz_wfwKlHOJbdH1d43Q "You can reuse questionnaire templates and document-request templates to speed up the creation of new questionnaires and document requests."), [Create a questionnaire or document request template using the Designer](https://www.servicenow.com/docs/Gy~ciPMCCCJgMzqnVkrglg "Use the Questionnaire Template Designer to create and edit questionnaire or document request templates that you can use as the basis for other templates."), and [Create a TPRM SAE questionnaire or document request template](https://www.servicenow.com/docs/0KK1qc~_6Mh_E6iRhdMe9g "Create a TPRM SAE questionnaire or document request template that supports SAE for risk identification. After integrating SAE, new users must create SAE templates, and existing users can create additional templates after migrating their existing ones.").
Based on the information gathered, the TPR manager and their team assess the potential risks that are associated with the engagement. They evaluate factors such as the financial stability, the operational
capacity, the adherence to quality standards, the compliance with regulations, and the third party's ability to meet delivery timelines. This assessment helps the team to understand the third party's risk profile
and to determine the appropriate risk mitigation strategies.
For more information about IRQs or internal assessments, see [Create an internal assessment](https://www.servicenow.com/docs/RRWKERDLA6GnTJ4mHYVS3g "Create an internal assessment as part of a due diligence request or ongoing risk monitoring using Third-party Risk Management. An internal assessment can affect which questionnaires are later sent to the third party or engagement.") and [Respond to an internal assessment](https://www.servicenow.com/docs/GUqiVWXcDW6QAqP5DAtTUA "Respond to an Inherent Risk Questionnaire (IRQ) or internal assessment that has been assigned to your queue. Your responses to the questionnaire help determine if the process moves forward and can affect which questionnaires are sent to the third party or engagement.").
Third-party (TP) element collection process: Collect TP element information
:
:
Collecting TP elements is optional. Depending on your due diligence process, you can add elements directly in the Elements grid, or the system can create a task that assigns the work to the due diligence requester or to a third-party or engagement contact.
Note:
In previous releases, TP elements were created by manually reviewing responses to a completed collection questionnaire. TP elements are now created directly, either in the Elements grid or through a collection task.
The TP element collection process includes the following steps.
1. If AI assets are involved in the engagement, the due diligence requester selects AI assets involved when creating the due diligence request.
2. The due diligence request owner selects Start onboarding. If the requester selected AI assets involved, the system also creates an internal task that assigns the due diligence requester to add AI use case elements.
3. To collect more elements from the third party or engagement, the due diligence request owner selects Start collection. The system creates a task and assigns it to a third-party or engagement contact.
4. The third-party or engagement contact, or the due diligence requester for an internal task, completes the task by adding or editing elements in the Elements grid. For more information, see [Complete an element collection task](https://www.servicenow.com/docs/MqeolPdbAkxJnB8Set6HsQ "Element collection tasks let internal users add AI use case elements and let third-party or engagement contacts add elements on behalf of the third party in the Third-party Risk Management application.") and [Manage elements in the grid](https://www.servicenow.com/docs/d3OFDqtfNa~kRdcMEsPBgQ "Manage third-party elements in the Elements grid by adding, editing, and deleting records. You can also link AI models to AI use case elements in the Third-party Risk Management application.").
5. When ready to begin element-level assessments, the due diligence request owner selects Start due diligence. An assessment is created only for elements marked Assessment required.
{#tprm-assessing-tpr__ol_thf_wbf_ddc}
This is an optional process for collecting TP elements and assigning them to engagements so that they can be assessed as part of the overall due diligence workflow. For more information on TP elements, see [Monitoring third-party elements](https://www.servicenow.com/docs/LiVqdtaHaqdxmaSA6U~ZJg "Monitor third-party elements using scalable scoring models, relationship analysis, and due diligence workflow integration in the Third-party Risk Management application to conduct more informed risk assessments as part of your third-party risk program.").
Due diligence process: Compliance verification
: The following infographic shows the due diligence process.
: The following are the steps of the Due diligence process.
1. After the IRQ process or TP element collection process is completed, the TPR manager or owner selects questionnaires and requests for documentation to attach to external assessments for sending to the third party or engagement. For more information on creating assessments, see [Create an external assessment](https://www.servicenow.com/docs/mVLrbcbubmLZeOQexSoRgQ "Create an assessment and initiate the third-party risk assessment life cycle using Third-party Risk Management. An external assessment specifies the details for the third party or engagement and defines the plan for completing the assessment.") and [Third-party risk assessment form](https://www.servicenow.com/docs/2XArj4zgt9a3MVsViwpdlQ "Use the third-party risk assessment form to capture all the information that you need to create an assessment using the Third-party Risk Management application. As a third-party risk assessor or manager, you can create an external assessment.").
Note:
* If you completed the optional TP element collection process, selecting Start due diligence automatically creates an assessment for each element marked Assessment required. This scope is available only when the third party uses the Smart Assessment Engine. Third-party and engagement contacts can respond to these element-scoped assessments in the third-party portal the same way they respond to engagement-scoped assessments.
* If the SBOM required field was selected on the due diligence request and the engagement uses the Smart Assessment Engine, the system automatically includes an SBOM questionnaire in the external assessment. For more information, see [Collecting software bill of materials](https://www.servicenow.com/docs/DnoMDiLODr_OwqY_vt93Bw "A software bill of materials provides an inventory of the components, libraries, and dependencies included in a vendor's software. Third-party Risk Management (TPRM) supports collecting SBOM files as part of the due diligence process.").
{#tprm-assessing-tpr__ul_q2t_5ks_jjc}
2. The system sends out an email notification to the third-party and engagement contact that has been assigned each assessment.
Note:
Don't change a questionnaire template after it has been sent out as part of an external assessment. Instead, duplicate the template by making a copy and make your changes in the new copy. If you update a questionnaire after it has been sent out, the changes won't appear in the version shown in the third-party portal. To send an updated version, you must cancel the existing questionnaire by deassociating it from the external assessment and then add the questionnaire using the updated template. For more information, see [Create a questionnaire or document request template](https://www.servicenow.com/docs/SS6tz_wfwKlHOJbdH1d43Q "You can reuse questionnaire templates and document-request templates to speed up the creation of new questionnaires and document requests."), [Create a questionnaire or document request template using the Designer](https://www.servicenow.com/docs/Gy~ciPMCCCJgMzqnVkrglg "Use the Questionnaire Template Designer to create and edit questionnaire or document request templates that you can use as the basis for other templates."), and [Create a TPRM SAE questionnaire or document request template](https://www.servicenow.com/docs/0KK1qc~_6Mh_E6iRhdMe9g "Create a TPRM SAE questionnaire or document request template that supports SAE for risk identification. After integrating SAE, new users must create SAE templates, and existing users can create additional templates after migrating their existing ones.").
3. After the third-party and engagement contacts submit their responses, the TPR manager or owner reviews and verifies all the required information was provided in the assessments. Issues and tasks are created if remediation or additional information is required.
4. The TPR manager or owner approves and closes each assessment.
{#tprm-assessing-tpr__ol_j11_52f_ddc}
The TPR manager can develop assessment templates to simplify and automate the process of determining which questionnaires and document requests to send to a third party of this type. The TPR
administrator can define questionnaire templates, document request templates, and then the TPR manager can group them into an assessment template. Your organization can reuse the template to send the
questionnaires and document requests to similar third parties in future assessments. For more information about templates, see [Create an external assessment template](https://www.servicenow.com/docs/16v_45YpP~4UGXHocq_Jyw "When defining an assessment template, the third-party risk manager provides scheduling information for the third-party risk assessment."), [Create a questionnaire or document request template](https://www.servicenow.com/docs/SS6tz_wfwKlHOJbdH1d43Q "You can reuse questionnaire templates and document-request templates to speed up the creation of new questionnaires and document requests."), and [Create a questionnaire or document request template using the Designer](https://www.servicenow.com/docs/Gy~ciPMCCCJgMzqnVkrglg "Use the Questionnaire Template Designer to create and edit questionnaire or document request templates that you can use as the basis for other templates.").
The TPR manager and their team use the third party's responses and internal analysis to determine whether the third party meets all the necessary compliance
requirements. These requirements could include verifying the third party's compliance with applicable laws and regulations, such as environmental regulations, labor laws, and anti-corruption
policies.
Note:
The third-party risk assessor, manager, or admin can answer questions, modify responses, and submit external questionnaires on behalf of third parties or engagements. For more information, see [Respond to a questionnaire for a third party or engagement](https://www.servicenow.com/docs/SldFdwSaE8E9Ge7KLV0x6Q "Answer questions, modify responses, or submit external questionnaires for a third party or engagement by using Third-party Risk Management. You can save valuable time by responding for a third party or engagement when they have already provided the required information for a previous questionnaire.").
Due to the sensitive nature of the items involved, the TPR
manager and their team evaluate the third party's data security and privacy practices. They assess the third party's information security measures, data protection policies, access controls, and vulnerability
management processes. If the third party has access to proprietary information or customer data, they might require the third party to undergo a cybersecurity audit or provide evidence of their data protection
measures.
For more information about reviewing responses, see [Review responses to external questionnaires](https://www.servicenow.com/docs/JxiB34y2N68ecv_ttnDs8g "Third-party contacts use the Third-party portal to complete assessments and collaborate with the TPR manager in the comments section for each question. When assessments reveal gaps, the TPR manager or the TPR assessor can generate an issue or task. In addition, the Vendor Management Workspace application can auto-generate issues.").
Note:
Your TPR assessor can export Responses received or Returned questionnaires to Microsoft Excel spreadsheets when using the Classic assessment engine. This option enables your organization to use the spreadsheet environment to review the questions and answers. For more information about exporting questionnaire responses, see [Export questionnaire responses to a spreadsheet](https://www.servicenow.com/docs/m4KG1ckaXDT2k4pAGqLLWg "Export received or returned questionnaires to Microsoft Excel spreadsheets. This option enables you to use the spreadsheet environment to review questions and answers.").
## Pre-populate questionnaires with responses {#tprm-assessing-tpr__section_atk_vdr_qdc}
The TPR manager or TPR assessor can pre-populate questionnaires for third parties and engagements with responses from complete questionnaires associated with the same third party. After sending out the assessment, the questionnaire is pre-populated with all responses from the most recent completed version of that questionnaire, regardless of whether the original associated assessment is completed. This is helpful for questionnaires where responses are expected to remain consistent, expediting the process and enabling third-party contacts to review and update responses only if necessary. For more information on creating assessments, see [Create an external assessment](https://www.servicenow.com/docs/mVLrbcbubmLZeOQexSoRgQ "Create an assessment and initiate the third-party risk assessment life cycle using Third-party Risk Management. An external assessment specifies the details for the third party or engagement and defines the plan for completing the assessment.").
Important:
When the TPR manager or TPR assessor adds a questionnaire to an assessment, they have the option to select or deselect the Include previous responses option on the questionnaire page. The option can't be changed after the questionnaire is sent to the third party. For more information, see [Create a questionnaire or document request template](https://www.servicenow.com/docs/SS6tz_wfwKlHOJbdH1d43Q "You can reuse questionnaire templates and document-request templates to speed up the creation of new questionnaires and document requests.") and [Assessment metric type form](https://www.servicenow.com/docs/mTc2xkBuA2SRGSfUCaFEjg "Use the assessment metric type form to capture all the information that you need to create a questionnaire template using the Third-party Risk Management application. As a third-party risk admin, you can create a questionnaire template.").
When a third-party or engagement contact opens a pre-populated questionnaire in the Third-party portal, they receive a notification that the responses were copied from an earlier questionnaire. The notification includes a
link to the assessment that supplied the responses and its last updated date as shown in the following example.
Limitations:
* Some question types and their responses can't be pre-populated such as the attachment, duration, and signature question types. These question responses remain blank and previous responses aren't included.
* Responses are copied from the original assessment (Assessment A) to the newer assessment (Assessment B) one time. This copying occurs when Assessment B is submitted to a third party or an engagement. Any changes you make to Assessment A afterward won't be reflected in Assessment B. Both assessments remain separate.
* Inactive and retired metrics are excluded when copying responses between assessments.
{#tprm-assessing-tpr__ul_sht_whq_xdc}
If the Smart Assessment Response Assist skill is active and template categories are configured for AI-assisted responses, internal and external assessment respondents can use ServiceNow Otto for Third-party Risk Management (TPRM) to generate draft responses from Document Management System documents and previously completed assessments. For more information, see [AI-assisted questionnaire pre-fill using the Document Management System](https://www.servicenow.com/docs/eJ1TUljh3KW~cO5dM08Iiw "Use the Document Management System (DMS) with the Smart Assessment Engine (SAE) to automatically generate draft responses for third‑party risk assessment questionnaires using vendor documents and previously answered assessments.").
## Issues and tasks {#tprm-assessing-tpr__section_lln_5gn_pzb}
The role of TPR assessor \[sn_vdr_risk_asmt.vendor_assessor\] is required to create and manage both tasks and issues.
The TPR manager, TPR assessor, or contract negotiator can create tasks to help ensure that a team member or the third-party contact responds to concerns about the questionnaire responses or requested documents. They can
manage existing tasks to verify that the assigned team member or third-party contact responds to a task and updates it as needed. For more information about creating and managing issues, see [Create a task for a third party or engagement](https://www.servicenow.com/docs/iocG0A00MIJmF4Y42oLM7g "Create a task to help ensure that a user at your organization or the third-party contact responds to your concerns about questionnaire responses or requested documents during the due diligence process.") and [Manage a task for a third party or engagement](https://www.servicenow.com/docs/SOOIhn5GCdXCGiZENMKRNg "Verify that the Assigned to user at your organization or the third-party contact responds to a task and update the state of the task as needed.").
For follow-up work that stays within your own organization instead of going to a third-party contact, TPR assessors \[sn_vdr_risk_asmt.vendor_assessor\] can create internal tasks and assign them to any internal
user. Internal tasks aren't visible in the Third-party portal and can be used for a variety of follow-up needs. For more information, see [Create a task for an internal user](https://www.servicenow.com/docs/ipeXaSVIb_Oq2EtGoqtt9A "Create an internal task to assign follow-up work to an internal user, rather than to a third-party contact, as part of your organization's third-party risk processes.").
Before creating an issue manually, TPR assessors \[sn_vdr_risk_asmt.vendor_assessor\] can use ServiceNow Otto for TPRM to generate a quick summary of an existing issue, or to get AI-driven recommendations for potential issues based on assessment responses and historical data. For more information,
see [Generate a summary of a TPRM issue](https://www.servicenow.com/docs/KB2CchzYMiEcKMZPLh1_ag "Generate a summary of a TPRM issue to support efficient triaging, remediation, and reporting using the TPRM issue summarization skill. Summarized issues help risk assessors and analysts quickly review issue content and take informed action.") and [Generate issue recommendations for TPRM](https://www.servicenow.com/docs/NZSK65AINej9IQIAleAS_A "Use generative AI to identify and recommend potential Third-party Risk Management issues based on assessment responses. The TPRM issue recommendation skill presents recommended issues with rationalized summaries for reviewer confirmation.").
Note:
Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see [ServiceNow product tiers](https://www.servicenow.com/docs/access?context=ai-native-sku-overview&version=brazil&pubname=brazil-intelligent-experiences&ft:locale=en-US).
The TPR manager, TPR assessor, or contract negotiator can also create an issue manually to help ensure the teams concerns about a third party or engagement are remediated. They can also manage the existing issues to verify that they're
understood, shared with the correct persons, and are acted on as needed. For more information about creating and managing tasks, see [Create an issue for a third party or engagement](https://www.servicenow.com/docs/cA_BulmH9DEtcxdNpVD~7g "Create an issue to help ensure that your concerns about a third party or engagement are remediated.") and [Manage issues](https://www.servicenow.com/docs/l5tff6ESAwzf4ZohSXuBEg "Verify that an issue that is associated with a risk assessment is understood, communicated to the appropriate persons, and is acted on as needed.").
## Additional assessment actions {#tprm-assessing-tpr__section_fn5_z2k_h1c}
The TPR manager, due-diligence request owner, or contract negotiator may need to reopen an assessment because there's new information available that impacts the engagement or some other change has occurred. For more
information, see [Why you conduct due diligence](https://www.servicenow.com/docs/NIFxeR0FFqFyyDjXVTsLQg "Conducting due diligence on third parties is a crucial component of your comprehensive third-party risk program. You conduct due diligence to become aware of the risks that are associated with a third party so that you can confidently decide how to form your relationship.").
If the TPR manager, due-diligence request owner, or contract negotiator must gather more information from an engagement, they can send out an additional questionnaire or document request by reopening an assessment and doing the following actions:
1. Navigate to the Due diligence request record page by selecting the relevant DDR number.
2. View the related third-party risk assessment by selecting the VRA number on the External assessments tab.
3. Select Re-open.
{#tprm-assessing-tpr__ol_wqm_55z_31c}
The due diligence request state updates from Ready for TPRM approval to Due diligence. The TPR manager, owner, or contract negotiator can request questionnaires and document requests as needed. For more information, see [Reopen an assessment](https://www.servicenow.com/docs/2O9HxSaD2p3kqF0K~J7Siw "Reopen an assessment to send out more questionnaires and document requests to collect required additional information from the third party or engagement.").
If the TPR manager, due-diligence request owner, or contract negotiator doesn't require an assessment for an ongoing engagement or requires a quick close for onboarding or renewing an engagement, they can cancel an assessment by doing the following actions:
1. Navigate to the Due diligence request record page by selecting the relevant DDR number.
2. View the related third-party risk assessment by selecting the VRA number on the External assessments tab.
3. Select Cancel.
{#tprm-assessing-tpr__ol_ash_bvz_31c} Even if one or all assessments are canceled, the due diligence request proceeds to the Approval process.
**Related concepts**
* [Collecting software bill of materials](https://www.servicenow.com/docs/DnoMDiLODr_OwqY_vt93Bw "A software bill of materials provides an inventory of the components, libraries, and dependencies included in a vendor's software. Third-party Risk Management (TPRM) supports collecting SBOM files as part of the due diligence process.")
* [AI-assisted questionnaire pre-fill using the Document Management System](https://www.servicenow.com/docs/eJ1TUljh3KW~cO5dM08Iiw "Use the Document Management System (DMS) with the Smart Assessment Engine (SAE) to automatically generate draft responses for third‑party risk assessment questionnaires using vendor documents and previously answered assessments.")
**Related tasks**
* [Request a software bill of materials from an engagement](https://www.servicenow.com/docs/bTTa32BbtMcgLsf3kd4wpg "Turn on SBOM collection on a due diligence request and send the external assessment to collect SBOM data from an engagement contact.")