---
sourceDocument: Yokohama Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/governance-risk-compliance
Release :
- yokohama
ft:locale :
- en-US
ft:publication_title :
- Yokohama Governance, Risk, and Compliance
ft:clusterId :
- grc
bundleId :
- grc
workflow :
- Technology
---
# Assess third-party risk
# Assessing your third-party risk {#ariaid-title1}
* Release version: Yokohama
*
* Updated March 12, 2026
*
*  9 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Assessing your third-party risk
ServiceNow's Third-party Risk Management (TPRM) enables organizations to identify, assess, and mitigate risks associated with third-party relationships.
By collecting data through internal and external questionnaires and document requests, TPRM helps you evaluate a third party's risk profile, compliance status, and operational capabilities.
This process supports informed decision-making and ensures third parties meet necessary compliance and security standards.
Show full answer Show less
## Questionnaire Response Processes
The assessment workflow involves several key processes:
* **Inherent Risk Questionnaire (IRQ) process:** After approval, the IRQ is assigned to an internal assessor who completes the questionnaire. The TPR manager reviews responses and updates the due diligence request status accordingly. Note that questionnaire templates should not be modified once sent; instead, duplicate and update copies to maintain version integrity.
* **Third-party (TP) Element Collection process:** Post-IRQ, if additional data is required, questionnaires are sent to third-party contacts to collect specific element information. Responses are reviewed and recorded as TP element records, which are optionally included in the due diligence workflow.
* **Due Diligence process:** Following IRQ and TP element collection, external assessments with questionnaires and document requests are sent to third parties or engagements. The TPR manager reviews responses, manages remediation tasks if needed, and determines compliance with laws, regulations, and security standards.
## Key Features
* **Questionnaire and Document Request Templates:** Templates can be created and grouped into assessment templates for reuse, streamlining the process for similar third parties.
* **Pre-populating Questionnaires:** Responses from previously completed questionnaires can be copied to new assessments to accelerate completion, though some question types cannot be pre-populated.
* **Issue and Task Management:** Roles such as TPR assessor can create and manage tasks and issues to address concerns arising from questionnaire responses or document requests, ensuring accountability and resolution.
* **Assessment Lifecycle Actions:** Assessments can be reopened to collect additional information or canceled if no further evaluation is needed, while still proceeding to approval.
## Key Outcomes
By implementing these processes, ServiceNow customers can:
* Gain a comprehensive understanding of third-party risk profiles including financial stability, compliance, operational capacity, and security posture.
* Ensure third parties meet regulatory and internal compliance requirements through structured due diligence and documentation.
* Efficiently manage assessment workflows with reusable templates, automated notifications, and pre-populated data to reduce manual effort.
* Maintain clear accountability and remediation through task and issue tracking tied to risk assessments.
* Adapt assessments dynamically by reopening or canceling as business needs evolve, without disrupting overall due diligence governance.
Use Third-party Risk Management to identify and assess potential risks that are associated with your third-party relationships. The information gathered from internal questionnaires, external questionnaires, and documentation requests helps you to understand the third party's risk profile, determine the appropriate risk mitigation strategies, and determine whether the third party or engagement meets all necessary compliance requirements.
## Responding to questionnaires {#tprm-assessing-tpr__section_gg3_dys_pzb}
The following processes outline the timing and methods for responding to internal and external questionnaires:
Inherent Risk Questionnaire (IRQ) process
: The following infographic shows the IRQ process.
:
The following are the steps of the IRQ process.
1. After the due diligence request is approved by the Third-party risk (TPR) manager \[sn_vdr_risk_asmt.vendor_risk_manager\] or TPR assessor \[sn_vdr_risk_asmt.vendor_assessor\] that has been assigned as the owner of the due diligence request, they select an IRQ and attach it to an internal assessment.
2. The system sends out an email notification to the employee that has been assigned as the IRQ assessor \[snc_internal\].
3. The IRQ assessor completes the internal assessment by responding to the IRQ.
4. After the IRQ assessor submits their responses and the TPR manager or owner reviews and closes the IRQ, the due diligence request state updates from IRQ in progress to IRQ in review.
Note:
Don't change a questionnaire template after it has been sent out as part of an internal assessment. Instead, duplicate the template by making a copy and make your changes in the new copy. If you update a questionnaire after it has been sent out, the changes won't appear in the version shown to the IRQ assessor. To send an updated version, you must cancel the existing questionnaire by deassociating it from the internal assessment and then add the questionnaire using the updated template. For more information, see [Create a questionnaire or document request template](https://www.servicenow.com/docs/rYNvLqC6psePKTi4UYhvBg "You can reuse questionnaire templates and document-request templates to speed up the creation of new questionnaires and document requests."), [Create a questionnaire or document request template using the Designer](https://www.servicenow.com/docs/eDd~oFKqLWutAjg4wKCx~Q "Use the Questionnaire Template Designer to create and edit questionnaire or document request templates that you can use as the basis for other templates."), [Create a TPRM SAE questionnaire or document request template](https://www.servicenow.com/docs/1r3yvMsjLYmzFZvgXyv~sg "Create a TPRM SAE questionnaire or document request template that supports SAE for risk identification. After integrating SAE, new users must create SAE templates, and existing users can create additional templates after migrating their existing ones.").
Based on the information gathered, the TPR manager and their team assess the potential risks that are associated with the engagement. They evaluate factors such as the financial stability, the operational
capacity, the adherence to quality standards, the compliance with regulations, and the third party's ability to meet delivery timelines. This assessment helps the team to understand the third party's risk profile
and to determine the appropriate risk mitigation strategies.
For more information about IRQs or internal assessments, see [Create an internal assessment](https://www.servicenow.com/docs/a~fMhMIpnFlH~_qf2danLg "Create an internal assessment as part of a due diligence request or ongoing risk monitoring using Third-party Risk Management. An internal assessment can affect which questionnaires are later sent to the third party or engagement.") and [Respond to an internal assessment](https://www.servicenow.com/docs/~1D5frh00Omkqnytz~WtZg "Respond to an Inherent Risk Questionnaire (IRQ) or internal assessment that has been assigned to your queue. Your responses to the questionnaire help determine if the process moves forward and can affect which questionnaires are sent to the third party or engagement.").
Third-party (TP) element collection process: Collect TP element information
: The following infographic shows the TP element collection process.
:
The following are the steps of the TP element collection process.
1. After your due diligence request has completed the IRQ process, if TP elements are needed, the TPR manager or due diligence request owner selects Start collection and a collection task is created.
2. The TPR manager or owner assigns TP element questionnaires to an external assessment for collecting elements and sends that assessment to a third-party engagement to collect required information for TP elements.
3. The system sends out an email notification to the third-party engagement contact that has been assigned the TP element questionnaire.
4. After the third-party engagement contact submits their responses, the TPR manager or owner reviews and verifies all the required information was provided in the questionnaires.
5. The TPR manager or owner then navigates to the list of third-party elements and manually creates a third-party element record for each set of responses in each questionnaire.For more information, see [Create a third-party element record](https://www.servicenow.com/docs/OsJMMPzNVcY6_67_j8GHhA "Create a third-party element record after you collect the responses from a third party by using a collection template questionnaire in the Third-party Risk Management application. Third-party element records are assessed directly as part of the due diligence workflow.").
6. After all TP elements are created, the TPR manager or owner closes the collection task assessment. The system changes the state of the request from Collection in progress to Collection in review.
7. The internal stakeholders (TPR assessor, TPR approver, TPR manager, or TPR administrator) review and approve the element records.
{#tprm-assessing-tpr__ol_thf_wbf_ddc}
This is an optional process for collecting TP elements and assigning them to engagements so that they can be assessed as part of the overall due diligence workflow. For more information on TP elements, see [Monitoring third-party elements](https://www.servicenow.com/docs/yOIu5SyPRledcChT1Ekkmw "You can monitor third-party elements through scalable scoring models, relationship analysis, and due diligence workflow integration by using the Third-party Risk Management application. Monitoring third-party elements and leveraging that information can help with conducting more informed risk assessments as part of your third-party risk program.").
Due diligence process: Compliance verification
: The following infographic shows the due diligence process.
: The following are the steps of the Due diligence process.
1. After the IRQ process or TP element collection process is completed, the TPR manager or owner selects questionnaires and requests for documentation to attach to external assessments for sending to the third party or engagement. For more information on creating assessments, see [Create an external assessment](https://www.servicenow.com/docs/S6Sqo4CTuE7nNjjFVXs0SQ "Create an assessment and initiate the third-party risk assessment life cycle using Third-party Risk Management. An external assessment specifies the details for the third party or engagement and defines the plan for completing the assessment.") and [Third-party risk assessment form](https://www.servicenow.com/docs/IykUUNLGjfRWXGOTyc3R7w "Use the third-party risk assessment form to capture all the information that you need to create an assessment using the Third-party Risk Management application. As a third-party risk assessor or manager, you can create an external assessment.").
Note:
If you completed the optional TP element collection process, a questionnaire must be selected and assigned as part of an assessment for each third-party element you created. The TP element questionnaires are completed by the engagement contact.
2. The system sends out an email notification to the third-party and engagement contact that has been assigned each assessment.
Note:
Don't change a questionnaire template after it has been sent out as part of an external assessment. Instead, duplicate the template by making a copy and make your changes in the new copy. If you update a questionnaire after it has been sent out, the changes won't appear in the version shown in the third-party portal. To send an updated version, you must cancel the existing questionnaire by deassociating it from the external assessment and then add the questionnaire using the updated template. For more information, see [Create a questionnaire or document request template](https://www.servicenow.com/docs/rYNvLqC6psePKTi4UYhvBg "You can reuse questionnaire templates and document-request templates to speed up the creation of new questionnaires and document requests."), [Create a questionnaire or document request template using the Designer](https://www.servicenow.com/docs/eDd~oFKqLWutAjg4wKCx~Q "Use the Questionnaire Template Designer to create and edit questionnaire or document request templates that you can use as the basis for other templates."), [Create a TPRM SAE questionnaire or document request template](https://www.servicenow.com/docs/1r3yvMsjLYmzFZvgXyv~sg "Create a TPRM SAE questionnaire or document request template that supports SAE for risk identification. After integrating SAE, new users must create SAE templates, and existing users can create additional templates after migrating their existing ones.").
3. After the third-party and engagement contacts submit their responses, the TPR manager or owner reviews and verifies all the required information was provided in the assessments. Issues and tasks are created if remediation or additional information is required.
4. The TPR manager or owner approves and closes each assessment.
{#tprm-assessing-tpr__ol_j11_52f_ddc}
The TPR manager can develop assessment templates to simplify and automate the process of determining which questionnaires and document requests to send to a third party of this type. The TPR
administrator can define questionnaire templates, document request templates, and then the TPR manager can group them into an assessment template. Your organization can reuse the template to send the
questionnaires and document requests to similar third parties in future assessments. For more information about templates, see [Create an external assessment template](https://www.servicenow.com/docs/PTxAJ1z_33~Y0HS2OES5mA "When defining an assessment template, the third-party risk manager provides scheduling information for the third-party risk assessment."), [Create a questionnaire or document request template](https://www.servicenow.com/docs/rYNvLqC6psePKTi4UYhvBg "You can reuse questionnaire templates and document-request templates to speed up the creation of new questionnaires and document requests."), and [Create a questionnaire or document request template using the Designer](https://www.servicenow.com/docs/eDd~oFKqLWutAjg4wKCx~Q "Use the Questionnaire Template Designer to create and edit questionnaire or document request templates that you can use as the basis for other templates.").
The TPR manager and their team use the third party's responses and internal analysis to determine whether the third party meets all the necessary compliance
requirements. These requirements could include verifying the third party's compliance with applicable laws and regulations, such as environmental regulations, labor laws, and anti-corruption
policies.
Note:
The third-party risk assessor, manager, or admin can answer questions, modify responses, and submit external questionnaires on behalf of third parties or engagements. For more information, see [Respond to a questionnaire for a third party or engagement](https://www.servicenow.com/docs/w_KJXg6KQbqmev1_tuAqdA "Answer questions, modify responses, or submit external questionnaires for a third party or engagement by using Third-party Risk Management. You can save valuable time by responding for a third party or engagement when they have already provided the required information for a previous questionnaire.").
Due to the sensitive nature of the items involved, the TPR
manager and their team evaluate the third party's data security and privacy practices. They assess the third party's information security measures, data protection policies, access controls, and vulnerability
management processes. If the third party has access to proprietary information or customer data, they might require the third party to undergo a cybersecurity audit or provide evidence of their data protection
measures.
For more information about reviewing responses, see [Review responses to external questionnaires](https://www.servicenow.com/docs/vvVZqjlhHMKUIWRhSIWsgQ "Third-party contacts use the Third-party portal to complete assessments and collaborate with the TPR manager in the comments section for each question. When assessments reveal gaps, the TPR manager or the TPR assessor can generate an issue or task. In addition, the Vendor Management Workspace application can auto-generate issues.").
Note:
Your TPR assessor can export received or returned questionnaires to Microsoft Excel spreadsheets. This option enables your organization to use the spreadsheet environment to review the questions and answers. For more information about exporting questionnaire responses, see [Export questionnaire responses to a spreadsheet](https://www.servicenow.com/docs/yWXchHjHdKQjrXD9u6_v9Q "Export received or returned questionnaires to Microsoft Excel spreadsheets. This option enables you to use the spreadsheet environment to review questions and answers.").
## Pre-populate questionnaires with responses {#tprm-assessing-tpr__section_atk_vdr_qdc}
The TPR manager or TPR assessor can pre-populate questionnaires for third parties and engagements with responses from complete questionnaires associated with the same third party. After sending out the assessment, the questionnaire is pre-populated with all responses from the most recent completed version of that questionnaire, regardless of whether the original associated assessment is completed. This is helpful for questionnaires where responses are expected to remain consistent, expediting the process and enabling third-party contacts to review and update responses only if necessary. For more information on creating assessments, see [Create an external assessment](https://www.servicenow.com/docs/S6Sqo4CTuE7nNjjFVXs0SQ "Create an assessment and initiate the third-party risk assessment life cycle using Third-party Risk Management. An external assessment specifies the details for the third party or engagement and defines the plan for completing the assessment.").
Important:
When the TPR manager or TPR assessor adds a questionnaire to an assessment, they have the option to select or deselect the Include previous responses option on the questionnaire page. The option can't be changed after the questionnaire is sent to the third party. For more information, see [Create a questionnaire or document request template](https://www.servicenow.com/docs/rYNvLqC6psePKTi4UYhvBg "You can reuse questionnaire templates and document-request templates to speed up the creation of new questionnaires and document requests.") and [Assessment metric type form](https://www.servicenow.com/docs/S0A~8pM_aCvCW_UBcKwnkg "Use the assessment metric type form to capture all the information that you need to create a questionnaire template using the Third-party Risk Management application. As a third-party risk admin, you can create a questionnaire template.").
When a third-party or engagement contact opens a pre-populated questionnaire in the Third-party portal, they receive a notification that the responses were copied from an earlier questionnaire. The notification includes a
link to the assessment that supplied the responses and its last updated date as shown in the following example.
Limitations:
* Some question types and their responses can't be pre-populated such as the attachment, duration, and signature question types. These question responses remain blank and previous responses aren't included.
* Responses are copied from the original assessment (Assessment A) to the newer assessment (Assessment B) one time. This copying occurs when Assessment B is submitted to a third party or an engagement. Any changes you make to Assessment A afterward won't be reflected in Assessment B. Both assessments remain separate.
{#tprm-assessing-tpr__ul_sht_whq_xdc}
## Issues and tasks {#tprm-assessing-tpr__section_lln_5gn_pzb}
The role of TPR assessor \[sn_vdr_risk_asmt.vendor_assessor\] is required to create and manage both tasks and issues.
The TPR manager, TPR assessor, or contract negotiator can create tasks to help ensure that a team member or the third-party contact responds to concerns about the questionnaire responses or requested documents. They can
manage existing tasks to verify that the assigned team member or third-party contact responds to a task and updates it as needed. For more information about creating and managing issues, see [Create a task for a third party or engagement](https://www.servicenow.com/docs/rI4dDG4miwAHaHnJo0A~Pg "Create a task to help ensure that a user at your organization or the third-party contact responds to your concerns about questionnaire responses or requested documents during the due diligence process.") and [Manage a task for a third party or engagement](https://www.servicenow.com/docs/ao9kWYxnuNTmeubf0jFnew "Verify that the Assigned to user at your organization or the third-party contact responds to a task and update the state of the task as needed.").
The TPR manager, TPR assessor, or contract negotiator can create an issue to help ensure the teams concerns about a third party or engagement are remediated. They can also manage the existing issues to verify that they're
understood, shared with the correct persons, and are acted on as needed. For more information about creating and managing tasks, see [Create an issue for a third party or engagement](https://www.servicenow.com/docs/LgkquqS8KxQ2i7uUqWTILg "Create an issue to help ensure that your concerns about a third party or engagement are remediated.") and [Manage issues](https://www.servicenow.com/docs/ZSPoyKuw_~XxUELADWKaZQ "Verify that an issue that is associated with a risk assessment is understood, communicated to the appropriate persons, and is acted on as needed.").
## Additional assessment actions {#tprm-assessing-tpr__section_fn5_z2k_h1c}
The TPR manager, due-diligence request owner, or contract negotiator may need to reopen an assessment because there's new information available that impacts the engagement or some other change has occurred. For more
information, see [Why you conduct due diligence](https://www.servicenow.com/docs/yYIHumJ5NvhBdx4MCwF0zA "Conducting due diligence on third parties is a crucial component of your comprehensive third-party risk program. You conduct due diligence to become aware of the risks that are associated with a third party so that you can confidently decide how to form your relationship.").
If the TPR manager, due-diligence request owner, or contract negotiator must gather more information from an engagement, they can send out an additional questionnaire or document request by reopening an assessment and doing the following actions:
1. Navigate to the Due diligence request record page by selecting the relevant DDR number.
2. View the related third-party risk assessment by selecting the VRA number on the External assessments tab.
3. Select Re-open.
{#tprm-assessing-tpr__ol_wqm_55z_31c}
The due diligence request state updates from Ready for TPRM approval to Due diligence. The TPR manager, owner, or contract negotiator can request questionnaires and document requests as needed. For more information, see [Reopen an assessment](https://www.servicenow.com/docs/fK7ntT~XL0eeS5r6SG8VXg "Reopen an assessment to send out more questionnaires and document requests to collect required additional information from the third party or engagement.").
If the TPR manager, due-diligence request owner, or contract negotiator doesn't require an assessment for an ongoing engagement or requires a quick close for onboarding or renewing an engagement, they can cancel an assessment by doing the following actions:
1. Navigate to the Due diligence request record page by selecting the relevant DDR number.
2. View the related third-party risk assessment by selecting the VRA number on the External assessments tab.
3. Select Cancel.
{#tprm-assessing-tpr__ol_ash_bvz_31c} Even if one or all assessments are canceled, the due diligence request proceeds to the Approval process.