---
sourceDocument: Australia Release Notes
sourceDocumentLink: https://www.servicenow.com/docs/r/release-notes

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Release Notes

ft:clusterId :

    - rn

bundleId :

    - rn


---

# Third-party Risk Management release notes

# Third-party Risk Management release notes {#ariaid-title1}

Release version: Australia  
Updated May 22, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 11 minutes to read  
The ServiceNow®
Third-party Risk Management (TPRM) application provides a centralized process for managing your portfolio of third parties and their engagements, assessing and scoring risk and performing remediation. TPRM was enhanced and updated in the Australia release.

## Third-party Risk Management highlights for the Australia release {#grc-tprm-rn__grc-tprm-highlights}

[Australia Patch 5](https://www.servicenow.com/docs/86~p_JZvUlBB3FD_j8roSw "The Australia Patch 5 release contains important problem fixes."){#grc-tprm-rn__grc-tprm-highlights-1}

Starting with Australia Patch 5, Now Assist for Third-party Risk Management is now ServiceNow Otto® for TPRM. Your product entitlements remain unchanged. Check your entitlements to determine your access to specific features.{#grc-tprm-rn__grc-tprm-highlights-2}  
* Reduce manual data entry by using AI to pre‑fill questionnaires for third-party contacts and business owners.
* Use updated Standardized Information Gathering (SIG) questionnaire content for 2026.
* Automate Software Bill of Materials (SBOM) collection, integration, and vulnerability correlation with Unified Security Exposure Management (USEM) integration.
* Manage SAE assessment template versions to prevent changes from affecting in‑flight assessments.
* Add question-level comments and follow-up capabilities during SAE reviews.
* Maintain DORA Register of Information accuracy with automatic supply chain cascading updates and duplicate record detection for contractual arrangement and supply chain tables.
* Validate Legal Entity Identifier (LEI) codes against the GLEIF database during Register of Information reporting to identify format errors, checksum failures, and inactive or unissued entities.
{#grc-tprm-rn__ul_xds_q3k_sjc}  
* Enhance DORA Register of Information reporting with optional currency conversion and third‑party expense aggregation to generate consistent, regulator‑ready reports.
* Review the simplified third‑party elements process in the due diligence workflow.
* Access the unified content management module in the Vendor Management Workspace to view a centralized library of smart assessment templates.
{#grc-tprm-rn__ul_fnm_rvm_fhc}

[Australia Patch 1](https://www.servicenow.com/docs/YA7hULsClAMRpa0n7ju_1A "The Australia Patch 1 release contains important problem fixes.") {#grc-tprm-rn__grc-tprm-highlights-5}

Review the updated AI experience with three licensing tiers.{#grc-tprm-rn__grc-tprm-highlights-6}

See [Third-party Risk Management](https://www.servicenow.com/docs/access?context=third-party-risk-mgt-landing-page&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US) for more information.{#grc-tprm-rn__grc-tprm-highlights-7}

[Early availability](https://www.servicenow.com/docs/TXTe8MPKl5ffoAV6IlfT7A "The Australia release contains important problem fixes."){#grc-tprm-rn__grc-tprm-highlights-8}

Use generative AI to recommend TPRM issues for reviewer validation.{#grc-tprm-rn__grc-tprm-highlights-9}
Note:  
Third-party Risk Management is available in ServiceNow Store. For details, see the "Activation information" section of these release notes.

## Important information for upgrading Third-party Risk Management to Australia {#grc-tprm-rn__grc-tprm-upgrade-info}

If you're a VRM user upgrading to TPRM and upgrading to Australia from an earlier release, you must run each upgrade sequentially to ensure that fix scripts run correctly. For example, you must upgrade from Xanadu to Yokohama, Yokohama to Zurich, and so on. If the scripts don't run in the correct order, you can get data inconsistencies, broken functionalities, and conflicts.{#grc-tprm-rn__grc-tprm-upgrade-info-1}  
After upgrading to version 21.0.x, you can enable the Smart Assessment Engine (SAE) by setting the Smart Assessment Engine enabled (sn_vdr_risk_asmt.sae_enabled) property. After setting this property, Smart Assessment Engine (SAE) is set to the default assessment engine and replaces the legacy experience. The transition is irreversible.  
Warning:  
Set this property in your non-production instances and conduct thorough testing before changing your production instances. Failure to do so can result in unexpected issues.

For more information on upgrading from VRM to TPRM and the differences between the Smart and Classic Assessment engines, see [Third-party Risk Management upgrade information](https://www.servicenow.com/docs/XFP9Pa_EEcHqvsMqEn_tiA "ServiceNow Third-party Risk Management application upgrade information for the Australia release.").{#grc-tprm-rn__grc-tprm-upgrade-info-4}

For existing TPRM customers, after upgrading to version 21.0.3, data from the Industry column in the Company \[core_company\] table is automatically migrated to the tprm_industry column. Migration
can take several hours depending on the number of records in the Company \[core_company\] table. After migration, a system log message confirms that the migration is complete. Review the Company \[core_company\] table content.
Update any customizations that reference the Industry field to use tprm_industry. After verifying the migration and updating customizations, you can drop the Industry column.{#grc-tprm-rn__grc-tprm-upgrade-info-5}

After upgrading to version 22.3.3, the `grc_business_user` and `grc_reader` roles are no longer directly inherited by TPRM roles. During upgrade, most users are automatically migrated to new feature‑specific roles. Users with custom role combinations may not be migrated automatically and require
manual review before the grace period ends.{#grc-tprm-rn__grc-tprm-upgrade-info-6}

## New in the Australia release {#grc-tprm-rn__grc-tprm-new-features}

[AI-assisted questionnaire pre-fill using the Document Management System](https://www.servicenow.com/docs/access?context=tprm-dms-sae&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.3.3 and activating the ServiceNow Otto for Third-party Risk Management (TPRM) application, you can use uploaded documents and responses from previous assessments to generate suggested questionnaire responses with source citations. For internal
    assessments, the snc_internal role is required. For external assessments, primary contacts can complete all assessment response actions; secondary contacts must be assigned read and write access.

[Software Bill of Materials (SBOM) support](https://www.servicenow.com/docs/access?context=tprm-sbom-exploring&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.3.2 and installing the required SBOM applications, if you have the third-party risk manager role \[sn_vdr_risk_asmt.vendor_risk_manager\] or third-party risk assessor role \[sn_vdr_risk_asmt.vendor_risk_assessor\], you can
    collect and manage SBOM data to support regulatory disclosure requirements.

[Standardized Information Gathering (SIG) 2026 questionnaires](https://www.servicenow.com/docs/access?context=tprm-sig-use-and-support&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.3.0, if you have the third-party risk manager role
    \[sn_vdr_risk_asmt.vendor_risk_manager\], you can use updated SIG Full, SIG Core, and SIG Lite templates for 2026 with expanded coverage across major security and privacy frameworks. Existing SIG questionnaire
    versions remain available. In‑flight assessments aren't affected.

[Smart Assessment template versioning](https://www.servicenow.com/docs/access?context=tprm-sae-using&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.3.3, if you have the third-party risk manager role
    \[sn_vdr_risk_asmt.vendor_risk_manager\], you can manage SAE template lifecycles using explicit versioning so that in-flight assessments use the version that was active when they were created.

[Legal Entity Identifier (LEI) validation for DORA reporting](https://www.servicenow.com/docs/access?context=tprm-valid-lei&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading the Digital Resilience Third-party Information Register application to version 22.3.1, if you have the third-party risk manager role \[sn_vdr_risk_asmt.vendor_risk_manager\], you can validate Legal Entity
    Identifier codes against the GLEIF database to support regulatory accuracy in Register of Information reporting. For descriptions of validation results and report columns, see [Level 4 LEI Validation Report columns](https://www.servicenow.com/docs/access?context=tprm-lei-validation-report&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US).

[Generate aggregate regulatory reports in local currencies](https://www.servicenow.com/docs/access?context=tprm-dora-currency-aggregation&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading the Digital Resilience Third-party Information Register application to version 22.0.3, third‑party risk (TPR) managers \[sn_vdr_risk_asmt.vendor_manager\] can standardize annual expense values during
    Register of Information report generation by enabling currency conversion and third‑party total expense aggregation. To support this process, the generated reporting package includes summary and detail reports
    that indicate successful conversions, aggregation results, and any skipped providers.

[Centralized repository for TPRM SAE templates](https://www.servicenow.com/docs/access?context=tprm-integrating-ucm&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.0.2 and installing the Unified Content Management
application, TPR managers \[sn_vdr_risk_asmt.vendor_risk_manager\] can help ensure consistent and comprehensive assessments by activating and updating ready‑to‑use Smart Assessment Engine questionnaire templates through a single, managed repository in the Vendor Management Workspace.  

**[Early availability](https://www.servicenow.com/docs/TXTe8MPKl5ffoAV6IlfT7A "The Australia release contains important problem fixes.")**
[Generate issue recommendations for TPRM](https://www.servicenow.com/docs/access?context=create-recommendation-tprm-issue&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.0.8 if you have the third‑party assessment reviewer role
\[sn_vdr_risk_asmt.vendor_assessment_reviewer\] and have installed the ServiceNow Otto for Third-party Risk Management (TPRM) application, you can use generative AI to automatically identify and recommend issues based on assessment responses. The TPRM issue management recommendation skill recommends issues with rationalized summaries. Recommended issues are presented for review and are created as standard TPRM issues only after user confirmation.  

**[Australia Patch 4](https://www.servicenow.com/docs/hpSe6FW9rwONQbG06dlmzQ "The Australia Patch 4 release contains important problem fixes.")**
[Extended AI model support for Now Assist for TPRM](https://www.servicenow.com/docs/access?context=supporting-information-now-assist-tprm&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.3.4, ServiceNow Otto for Third-party Risk Management (TPRM) supports Google Gemini 3.5 Flash, OpenAI GPT 5.1, and OpenAI GPT 5.4 mini models in addition to previously supported models. Model availability depends on your ServiceNow Otto for Third-party Risk Management (TPRM) subscription, providing greater flexibility when selecting the AI model that meets your requirements.

## UI changes {#grc-tprm-rn__grc-tprm-ui-changes}

[Improved handling of skipped conditional questions in SAE assessments](https://www.servicenow.com/docs/access?context=tprm-sae-using&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.3.3, Smart Assessment Engine assessments hide conditional questions that are skipped based on response logic. Sections that contain skipped questions are visually de‑emphasized, and assessments
    render in a continuous scroll layout.
:   This change affects the assessment review experience only and does not change assessment logic, scoring, or response data.

[Comments field in the third‑party portal saves when you leave the field](https://www.servicenow.com/docs/access?context=vendor-portal&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.3.2, the comments field in the third‑party portal saves when you leave the field rather than on every keystroke.

[Issue indicators in the third-party portal shown only after submission](https://www.servicenow.com/docs/access?context=vendor-portal&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.3.2, issue indicators appear in the third‑party portal only after an issue is submitted to the third party and the Visible in third‑party portal field is
    selected. Previously, indicators were visible before submission when the field was selected.

[Fields added to Create New Excel download/upload request form](https://www.servicenow.com/docs/access?context=tprm-create-report-aggregate-expenses&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading the Digital Resilience Third-party Information Register application to version 22.0.3, the Enable currency conversion and Enable third‑party total expense aggregation fields are available on the Excel download/upload request page. When creating Excel Master Template or Plain‑CSV Reporting Package requests, you can configure these options directly on
    the form.

[TPRM Unified content management page](https://www.servicenow.com/docs/access?context=tprm-ws-ucm-page&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.0.2 and installing the Unified Content Management application, the unified content management module is available in the Vendor Management Workspace.

## Changed in this release {#grc-tprm-rn__grc-tprm-changed-features}

[Consolidated assessment email notifications](https://www.servicenow.com/docs/access?context=set_sys_props_for_email&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.3.3, external assessment‑related email notifications are sent as a single consolidated summary instead of individual per‑event messages. Users can configure notification frequency,
    detail level, and delivery channel in their notification preferences. Multi‑language templates are available.

[Assessment count mechanism updated in the third-party portal](https://www.servicenow.com/docs/access?context=vendor-portal&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.3.3, engagement assessment counts in the third-party portal include only active, pending, and in‑progress assessments. Previously, counts included inactive and canceled
    assessments.

[Inactive metrics excluded when copying assessment responses](https://www.servicenow.com/docs/access?context=tprm-assessing-tpr&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.3.3, inactive and retired metrics are excluded when copying responses between assessments. Previously, copying responses could include inactive metrics, causing scoring errors.

[Type of ICT services changes cascade to supply chain in DORA reporting](https://www.servicenow.com/docs/access?context=tprm-drtp-reg-contract&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading the Digital Resilience Third-party Information Register application to version 22.3.1, when the Type of ICT services value is updated on a Contractual Arrangements -- Specific Information (B.02.02) record,
    the ICT service supply chain (B.05.02) is now updated automatically. If a Type of ICT services value is removed from a Specific Information record, the corresponding supply chain records for Rank 1 and higher
    ranks are also deleted automatically. Previously, Rank 1 supply chain records were generated when the Specific Information record was first created, but subsequent changes or removals did not propagate to the
    supply chain, requiring manual correction.

[Duplicate contractual arrangements detected and warned in DORA Register of Information](https://www.servicenow.com/docs/access?context=tprm-drtp-reg-contract&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading the Digital Resilience Third-party Information Register application to version 22.3.1, duplicate records in the Contractual Arrangements -- Specific Information (B.02.02) table are now detected and handled
    across three scenarios. When saving a contractual arrangement from the UI, a business rule checks eight composite key fields and blocks the save if a duplicate is found. During Excel upload, duplicate rows are
    rejected and logged to the upload error report. During CSV package download, duplicate rows in B.02.02 are flagged in the DORA request record's error log; duplicates are warned but not removed from the generated CSV.

[Duplicate supply chain rows warned during DORA CSV package download](https://www.servicenow.com/docs/access?context=tprm-drtp-roi-packages&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading the Digital Resilience Third-party Information Register application to version 22.3.1, during CSV package download, duplicate rows in the ICT service supply chains (B.05.02) table are now detected and a
    warning is added to the request record. This applies to both Rank 1 supply chain records, which are auto-generated from Specific Information records, and higher-ranked records. Additionally, when the Storage of
    data field is set to No on a contractual arrangement, associated location field values are now cleared automatically.

[Simplified third-party element process](https://www.servicenow.com/docs/access?context=tprm-workflow-in-workspace&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.0.1, third‑party elements are now linked to a single third party and can no longer be shared across third parties. Scoring rollups calculate results from element‑level assessments
rather than entity records.  

[Australia Patch 5](https://www.servicenow.com/docs/86~p_JZvUlBB3FD_j8roSw "The Australia Patch 5 release contains important problem fixes.")
: Starting with Australia Patch 5, Now Assist for Third-party Risk Management is now ServiceNow Otto® for TPRM. Your product entitlements remain unchanged. Check your entitlements to determine your access to specific features.  

**[Australia Patch 4](https://www.servicenow.com/docs/hpSe6FW9rwONQbG06dlmzQ "The Australia Patch 4 release contains important problem fixes.")**
[Default AI model for issue recommendation skill](https://www.servicenow.com/docs/access?context=supporting-information-now-assist-tprm&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   After upgrading to version 22.3.4, the issue recommendation skill in ServiceNow Otto for Third-party Risk Management (TPRM) uses Azure OpenAI gpt-4-5-mini as the default model. This update changes the default model for issue recommendations. You can select alternative models, including the newly
    supported Google Gemini 3.5 Flash, OpenAI GPT 5.1, and OpenAI GPT 5.4 mini, based on your requirements.

[Large language models on the ServiceNow AI Platform®](https://www.servicenow.com/docs/access?context=exploring-large-language-models&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US)
: The Now LLM Service is no longer the default model provider for new or inactive AI assets. A third-party LLM is now selected by default, while existing configurations using the Now LLM Service continue unchanged. The Now LLM Service is still available for manual selection.  

**[Australia Patch 1](https://www.servicenow.com/docs/YA7hULsClAMRpa0n7ju_1A "The Australia Patch 1 release contains important problem fixes.")**
[ServiceNow product tiers](https://www.servicenow.com/docs/access?context=ai-native-sku-overview&version=australia&pubname=australia-intelligent-experiences&ft:locale=en-US)
:   The ServiceNow AI Platform now brings you a new AI experience with three licensing tiers available:

    * Foundation: AI basics to deliver insights
    * Advanced: AI to boost productivity across relevant use cases
    * Prime: Act autonomously with all AI assets, and create your own

    {#grc-tprm-rn__ul_pgy_j1t_r3c}

    Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents.

## Removed in this release {#grc-tprm-rn__grc-tprm-removed-features}

* Assessments using entities are no longer supported.
* The `grc_business_user` and `grc_reader` roles are no longer directly inherited by TPRM roles.
* The `scoring_rule` and `scoring_rule_ref` fields are removed from assessment forms and UI sections. Custom scripts or integrations that reference these fields must be updated.
{#grc-tprm-rn__ul_hh3_lvf_mjc}

## Accessibility information {#grc-tprm-rn__grc-tprm-accessibility}

The Vendor Management Workspace and the third-party portal include accessibility improvements in this release, including improved color contrast, enhanced focus indicators, skip navigation links, and full keyboard
navigation.{#grc-tprm-rn__grc-tprm-accessibility-1}

## Localization information {#grc-tprm-rn__grc-tprm-localization}

Third-party portal strings are externalized and translated for supported languages. Newly introduced features may have incomplete translations.{#grc-tprm-rn__grc-tprm-localization-1}

## Activation information {#grc-tprm-rn__grc-tprm-activation}

Install Third-party Risk Management by requesting it from ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/r/store-release-notes/sn-store-release-notes.html).{#grc-tprm-rn__grc-tprm-activation-1}

## Related ServiceNow applications and features {#grc-tprm-rn__grc-tprm-related-apps}

[Operational Resilience](https://www.servicenow.com/docs/access?context=grc-opres-landing-page&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   Operational Resilience helps organizations respond to adverse operational events by anticipating, preventing, recovering from, and adapting to such events.

[Operational Resilience Workspace](https://www.servicenow.com/docs/access?context=working-in-opres-ws&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   Use Operational Resilience Workspace to manage your resilience tasks and monitor resilience metrics from a single dashboard.

[GRC Risk Management](https://www.servicenow.com/docs/access?context=grc-risk-overview&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   Use Risk Management with the ServiceNow®
    Advanced Risk application to identify and monitor high-impact risks, improve your risk-based decision-making, and reduce your reaction time from days to minutes.

[GRC Risk Workspace](https://www.servicenow.com/docs/access?context=risk-workspace&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   The Risk Workspace in the ServiceNow®
    Advanced Risk application provides a simplified user experience with a single-pane view for risk-related activities.

[Smart Assessment Engine](https://www.servicenow.com/docs/access?context=smart-asmnt-engine-landing-page&version=australia&pubname=australia-governance-risk-compliance&ft:locale=en-US)
:   The ServiceNow®
    Smart Assessment Engine (SAE) application helps you to reduce the manual burden and costs of your assessment processes through automation.
* **[Third-party Risk Management upgrade information](https://www.servicenow.com/docs/XFP9Pa_EEcHqvsMqEn_tiA)**   
  ServiceNow® Third-party Risk Management application upgrade information for the Australia release.