---
sourceDocument: Xanadu Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/governance-risk-compliance

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Request engagement due diligence

# Request due diligence for a third-party engagement {#ariaid-title1}

* Release version: Xanadu
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read

Request due diligence to assess the risk that is associated with doing business with an engagement. By conducting due diligence, you gain access to the most up-to-date, comprehensive, and accurate information before making a decision on entering into a business relationship.

## Before you begin

Role required: snc_internal

## About this task

Because your organization assesses the risk that is associated with doing business with third parties, it performs due diligence for any engagement with a third party. When you request due diligence, you specify the third
party's name and the reason for your request. For example, start a new engagement with a third party that you have already engaged or perform due diligence in preparation to renew a contract. You then specify the details that
help the Third-party Risk (TPR) managers and TPR assessors at your organization proceed with the due diligence processes. If a request is accepted, it initially goes through the IRQ process. After the IRQ process, as part of the
Due diligence process, two third-party risk assessments begin. One assessment is for the third party and another assessment is for the engagement. For more information, see [Due diligence workflow](https://www.servicenow.com/docs/uzVf3z7045XbK3i3qwKhjg "The Third-party risk management (TPRM) processes provide a consistent framework for your third-party risk management program. You can customize the workflow processes to meet your organization's needs.").  
Note:  
This feature is available only if the Third-party Risk Management application has been activated. After you install the Risk concentration map feature, you must install a Google license to enable the feature. To enable the risk concentration map feature, see [Enable the TPRM Risk concentration map](https://www.servicenow.com/docs/A4oTKBQWNNDi9aAEhxdAAQ "After you install the Risk concentration map feature, you must install a Google license to enable the feature.").

## Procedure

1. Navigate to AllSelf-ServiceEmployee Center to open your Employee Center and then select Risk \& Compliance.
2. Select the Request due diligence for third-party risk card.
3. On the request form, specify the purpose of your request.
   * Onboard a new engagement
   * Reassess an existing engagement
   * Reassess an existing engagement for contract renewal
   * Offboard an engagement with due diligence
   * Offboard an engagement with no due diligence

     For more information, see [Offboarding an engagement without conducting due diligence](https://www.servicenow.com/docs/Z1OQHZh5dluK6clSALfPvg "Request that an engagement be permanently terminated when an engagement ends or you want to switch to a different third party for other reasons. In this case, you typically don't need to conduct additional due diligence. The process does, however, include the normal Inherent Risk Questionnaire (IRQ) process to confirm that the services provided by the engagement will no longer continue.").

   {#tprm-ws-request-dd-for-engagement__choices_vyy_nfr_dyb}  
   For descriptions of each type of due diligence request, see [Requesting third-party risk due diligence](https://www.servicenow.com/docs/~xZ3sQLyKu4RbBLCcoZSQA "Request third-party risk due diligence to determine the level of risk for interactions with a third party, engagement, or fourth party by using Third-party Risk Management. You conduct due diligence to become aware of the associated risks so that you can make informed decisions, establish appropriate controls, and mitigate the potential negative impact when working with external parties.").
4. **Optional:** Select Add attachments to include a document with the request.
5. Specify the third party for the engagement.  
   You can request due diligence either for an engagement with a third party that you're already engaged with or for an engagement with a new third party.  
   Note:  
   You can reactivate a third party that is in the Terminated status. Terminated third parties appear in the list for requests of the Onboard a new engagement type. If such a request is accepted and closed, the third party's status is changed to Active.
   * For an engagement with an existing third party or with a department, partner, subsidiary, or fourth party of the third party:
     1. Select the third party from the list.
     2. The form expands and the system auto-populates the key information for the third party including the address and contact details.
     3. In the next step, enter the key information like the address and contact details for the engagement.
     {#tprm-ws-request-dd-for-engagement__ol_qxf_m1k_dyb}
   * For a new third party:
     1. Select the Third party is not listed check box.
     2. Enter the name of the new third party.
     3. The form expands. In the next step, you enter the key information like the address and contact details for the third party and for the engagement.
     {#tprm-ws-request-dd-for-engagement__ol_uzd_f1k_dyb}

   {#tprm-ws-request-dd-for-engagement__choices_ryl_cck_dyb}  
   If you selected an existing third party, much of the information is automatically filled in. For descriptions of these fields, see [Request third-party risk due diligence request form](https://www.servicenow.com/docs/H6T6LhyF815Ry_c7O10KRg "The due diligence request form captures all the initial information that you need to start the due diligence process. Any employee within your organization can request due diligence. If you’re selecting an existing third party, a significant portion of the information is automatically filled in.").
6. Select Submit.  
   * The system opens to the Activity tab on the My request page. For each due diligence request, the system auto-assigns a unique ID number that starts with the text DDR. Use the ID to track your request. You can post a message to reviewers and add attachments from the page.
   * The system sends you an email confirmation that your request was submitted. The message includes a link to the request details on the Third-party Risk Management application.
   * The system sends an email notification to all users in the group that is specified in the Assignment group. The message states that the request was received and is in the New state. The message also includes a link to the details page for the request.

   {#tprm-ws-request-dd-for-engagement__ul_hzz_rd1_qyb}  
   Note:  
   For new due diligence requests, the Assignment group is set to Due diligence request assigners. The TPR manager or owner can specify which group is the Assignment group on the Details tab for a due diligence request. For more information, see [Due diligence request process management](https://www.servicenow.com/docs/1wAjSczJEErls0SyxqWanw "From the Details tab, you can view and adjust the due diligence request information for a third party. You can also log external-facing comments and private work notes, attach files, and track request updates in the activity stream.") and [Add users to groups based on responsibilities](https://www.servicenow.com/docs/yWx1owvwOau4EjQvfCwmXQ "Assign users to groups before you implement or use the Third-party Risk Management application. Each group contains users with particular roles. Well-organized user groups simplify and improve process management and help to ensure that users are promptly notified of tasks in their areas of responsibility.").
**Related concepts**   

* [Offboarding an engagement without conducting due diligence](https://www.servicenow.com/docs/Z1OQHZh5dluK6clSALfPvg "Request that an engagement be permanently terminated when an engagement ends or you want to switch to a different third party for other reasons. In this case, you typically don't need to conduct additional due diligence. The process does, however, include the normal Inherent Risk Questionnaire (IRQ) process to confirm that the services provided by the engagement will no longer continue.")

*[\>]: and then