--- sourceDocument: Yokohama Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/governance-risk-compliance Release : - yokohama ft:locale : - en-US ft:publication_title : - Yokohama Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Roles in TPRM # Roles in Third-party Risk Management {#ariaid-title1} * Release version: Yokohama * * Updated March 12, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Roles in Third-party Risk Management In Third-party Risk Management (TPRM) on ServiceNow, roles define permissions and access levels to manage third-party contacts, assessments, questionnaires, and risk-related activities. Assigning appropriate roles to users ensures controlled, secure, and efficient management of third-party risk processes. Show full answer Show less ## Key Roles and Their Responsibilities * **Third-party reader \[vendorreader\]**: Read-only access to third-party contact records. * **Third-party editor \[vendoreditor\]**: Can create, update, and delete third-party contact records. * **Third-party assessment reviewer \[snvdrriskasmt.vendorassessmentreviewer\]**: Views assessment and questionnaire data and can comment on risk-related tables; this is the minimum role to view TPRM templates. * **TPR assessor \[snvdrriskasmt.vendorassessor\]**: All reviewer permissions plus managing third parties, contacts, assessments, and risk issues; can be configured to answer or modify questionnaire responses. * **TPR approver \[snvdrriskasmt.approver\]**: Reviewer permissions plus approval capabilities for Internal Risk Questionnaires (IRQs). * **TPR manager \[snvdrriskasmt.vendorriskmanager\]**: Assessor permissions plus managing assessment templates, scheduled assessments, engagements, contacts, and scoring rules. * **TPR admin \[snvdrriskasmt.vendorriskadmin\]**: Manager permissions plus creating and editing assessment, tiering, questionnaire, document request templates, and post-assessment automation rules. * **Contract risk negotiator \[snvdrriskasmt.contractnegotiator\]**: Assessor permissions plus legal team access to modify contract statuses and dates; typically assigned to legal users. * **Third-party contact \[vendorcontact\]**: External users assigned by third-party organizations to respond to questionnaires, tasks, and issues via the Third-party portal; access is limited to external portal functions only. ## Roles for Digital Resilience Third-party Registers * **TPRM DORA user \[sndoraaccel.user\]**: Included in Third-party assessment reviewer and TPR approver roles; grants access to Digital Resilience modules. * **TPRM DORA manager \[sndoraaccel.manager\]**: Included in TPR assessor and manager roles. * **TPRM DORA admin \[sndoraaccel.admin\]**: Included in TPR admin role. ## Roles for Smart Assessment Engine (SAE) * **Template and assessment viewers**: Roles like TPRM SAE template reader and assessment reader allow users to view SAE templates and assessments. * **Questionnaire responders**: Internal and external assessment user roles enable responding to questionnaires via various portals; these roles are automatically assigned as appropriate. * **SAE admin and automation creators**: Roles that enable creating SAE templates and post-assessment automation rules; included in the TPR admin role. * **Minimum role to view SAE templates**: Third-party assessment reviewer role is required to access TPRM external and internal questionnaire templates. ## Roles for ServiceNow Otto for TPRM * Third-party assessment reviewers can use ServiceNow Otto skills for TPRM. * The TPRM GenAI User role is automatically granted to Third-party assessment reviewers after installing the ServiceNow Otto for TPRM application. ## Practical Application for ServiceNow Customers Assigning the correct TPRM roles ensures users have appropriate access to perform their responsibilities securely and efficiently. Roles range from read-only viewers to administrators who manage templates and automation. External third-party contacts have limited portal access to protect your ServiceNow environment. Additionally, integration with Digital Resilience registers, Smart Assessment Engine, and ServiceNow Otto expands functionality but requires specific roles for access and use. For effective role management, assign roles according to user responsibilities, and leverage user groups where applicable, such as adding legal users to the Contract risk negotiators group. Understanding these roles helps maintain compliance, streamline third-party risk processes, and enhance collaboration between internal teams and external vendors. Roles determine permissions and access in TPRM. ## TPRM roles {#tprm-roles__section_rcc_nl2_5xb} {#tprm-roles__table_o14_t2s_2mb__entry__3} | Friendly name \[role name\] | Description | Contains roles | |-|-|-| | Third-party reader \[vendor_reader\] | Read access to third-party contact records. | None | | Third-party editor \[vendor_editor\] | Create/update/delete third-party contact records. | None | | Third-party assessment reviewer \[sn_vdr_risk_asmt.vendor_assessment_reviewer\] | View assessment and questionnaire data. In addition to viewing, they can leave comments on the following tables: * Tiering assessment * Internal assessment * External assessment * Third-party risk issues * Third-party risk tasks * Third-party risk due diligence request {#tprm-roles__ul_gmy_qjz_fyb} | Contains: * compliance_reader * risk_reader * task_editor * vendor_reader * sn_dora_accel.user * sn_smart_asmt.template_reader * sn_smart_asmt.assessment_reader * sn_tprm_genai.nowassist_user {#tprm-roles__ul_mm2_g4p_qxb} | | TPR assessor (Third-party risk assessor) \[sn_vdr_risk_asmt.vendor_assessor\] | * Includes all permissions of the Third-party assessment reviewer role plus: Manage third parties, third-party contacts, external risk assessments, and issues. * You can set the following options for the sn_svdp.allow_assessor_edit property: * Enable TPR assessors to answer questions or modify responses in third-party questionnaires (default). * Enable TPR assessors to modify responses. * Don't enable TPR assessors to answer questions or modify responses. {#tprm-roles__ul_at3_m1f_zyb}See [Configure TPRM properties](https://www.servicenow.com/docs/pZaXWFHutN0JCkNdKbavkg "Configure property settings for a variety of TPRM operations."). {#tprm-roles__ul_twn_g1x_11c} | Contains: * compliance_reader * vendor_assessment_reviewer * vendor_editor * vendor_reader * sn_dora_accel.manager {#tprm-roles__ul_w3n_l4p_qxb} | | TPR approver \[sn_vdr_risk_asmt.approver\] | Includes all permissions of the Third-party assessment reviewer role plus: approve IRQs. | Contains: * vendor_assessment_reviewer * sn_dora_accel.user {#tprm-roles__ul_wps_rqh_xcc} | | TPR manager (Third-party risk manager) \[sn_vdr_risk_asmt.vendor_risk_manager\] | Includes all permissions of the TPR assessor role plus: * Manage third-party assessment templates and scheduled assessments. * Manage engagements and engagement contacts. * Manage scoring rules for both third parties and engagements. {#tprm-roles__ul_yrt_xxj_mxb} | Contains: * vendor_assessor * sn_dora_accel.manager {#tprm-roles__ul_klf_vqh_xcc} | | TPR admin (Third-party risk admin) \[sn_vdr_risk_asmt.vendor_risk_admin\] | Includes all permissions of the TPR manager role plus: Create and edit the following items: * Third-party assessment templates * Risk tiering templates * Risk tier questionnaire templates * Third-party questionnaire templates * Document request templates * Post assessment automation rules {#tprm-roles__ul_z5g_qxf_lzb} Note: All the templates include both classic and SAE templates. | Contains: * vendor_risk_manager * assessment_admin * sn_dora_accel.admin * sn_smart_asmt.assessment_admin * sn_smart_imp_auto.automation_creator | | Contract risk negotiator \[sn_vdr_risk_asmt.contract_negotiator\] | Includes all permissions of the TPR assessor role plus: Gives users in the legal department access to modify contract status and the start and expiration dates. You can add users with this role to the Contract risk negotiators user group. See [Add users to groups based on responsibilities](https://www.servicenow.com/docs/KODzeJOPDnmHSUnRvnDIUQ "Assign users to groups before you implement or use the Third-party Risk Management application. Each group contains users with particular roles. Well-organized user groups simplify and improve process management and help to ensure that users are promptly notified of tasks in their areas of responsibility."). | Contains: * vendor_assessor * sn_dora_accel.manager {#tprm-roles__ul_mbw_brh_xcc} | | \[vendor_contact\] * Called a third-party contact when responding to an external questionnaire/task/issue for a third party. * Called an engagement contact when responding to a questionnaire/task/issue for an engagement. {#tprm-roles__ul_upd_34n_cyb} | You assign the third-party contact role to users at the third-party organization whose risk is being assessed. Third-party contacts are assigned the snc_external role to give them access to resources and actions in the Third-party portal. Important: The third-party contact role should be used only for external contacts. The role prohibits access to your ServiceNow AI Platform instance and grants access only to the Third-party portal. You assign the primary contact responsibility to the third-party contact who can directly answer assessment questions or assign another contact at the third party to answer the questions. Primary contacts can manage other contacts for the third party. | Contains: snc_external | [ ] {#tprm-roles__table_o14_t2s_2mb} ## Roles required for accessing the Digital resilience third-party registers {#tprm-roles__section_xny_kcv_zzb} A user with one of the following roles can access the Digital resilience third-party registers related modules in the Vendor Management Workspace: * TPRM DORA user \[sn_dora_accel.user\] roleThird-party assessment reviewer and TPR approver contain this role. * TPRM DORA manager \[sn_dora_accel.manager\] roleTPR assessor and TPR manager contain this role. * TPRM DORA admin \[sn_dora_accel.admin\]The TPR admin contains this role. {#tprm-roles__ul_jj1_jdv_zzb} For more information on DORA related roles, see [Roles installed with Digital resilience third-party registers](https://www.servicenow.com/docs/TtrkPs6poHQTDG1t0pV9rw "Specific roles are installed with Digital resilience third-party registers."). ## Roles required for using Smart Assessment Engine {#tprm-roles__section_lbx_kcb_l2c} A user with one of the following roles can view templates in the Assessment Workspace: * TPRM SAE template reader \[sn_smart_asmt.template_reader\] role Third-party assessment reviewer contains this role. * TPRM SAE assessment reader \[sn_smart_asmt.assessment_reader\] role Third-party assessment reviewer contains this role. {#tprm-roles__ul_mbx_kcb_l2c} A user with one of the following roles can respond to questionnaires in the Vendor Management Workspace, GRC portal, or Third-party portal. * TPRM SAE internal assessment user \[sn_vdr_risk_asmt.internal_assessment_responder\] This role is automatically assigned to an assigned IRQ assessor or internal assessment respondent. This role is required to respond to internal/IRQ assessment questionnaires using the GRC Portal. This role contains the following roles: sn_grc_business_user, canvas_user, and sn_smart_asmt.actor. * TPRMSAE external assessment user \[sn_vdr_risk_asmt.external_assessment_responder\] This role is automatically assigned to the assigned third-party contact. This role is required to respond to external questionnaires using the Third-party portal. This contains the role: sn_smart_asmt.actor. {#tprm-roles__ul_bpm_ltt_ffc} A user with the TPRM SAE admin \[sn_smart_asmt.assessment_admin\] role can create SAE templates in the Vendor Management Workspace and Assessment Workspace. Third-party admin contains this role. A user with the sn_smart_imp_auto.automation_creator role can create post assessment impact automation rules. Third-party admin contains this role. Important: The Third-party assessment reviewer \[sn_vdr_risk_asmt.vendor_assessment_reviewer\] role is the minimum role that you must have to view any template that is a member of the TPRM external questionnaire, TPRM external document request, TPRM internal tiering questionnaire, and TPRM internal IRQ purposes. For more information on SAE related roles, see [Roles in Smart Assessment Engine](https://www.servicenow.com/docs/X4P67YEOrXRTfAyzEE13iA "Roles determine the permissions and access in the Smart Assessment Engine application."). ## Roles required for using ServiceNow Otto for Third-party Risk Management (TPRM) {#tprm-roles__section_ddc_dt1_lhc} A user with the Third-party Assessment reviewer \[sn_vdr_risk_asmt.vendor_assessment_reviewer\] role can use the ServiceNow Otto for TPRM skills. The TPRM GenAI User \[sn_tprm_genai.nowassist_user\] role is granted to Third-party Assessment reviewers \[sn_vdr_risk_asmt.vendor_assessment_reviewer\] automatically after you install the ServiceNow Otto for TPRM application. For more information about a ServiceNow Otto for TPRM, see [ServiceNow Otto for Third-party Risk Management (TPRM)](https://www.servicenow.com/docs/TRJUMpZvgSD7NyrZNikT8g "Use the ServiceNow ServiceNow Otto for Third-party Risk Management (TPRM) application to empower your risk management teams with generative AI-powered capabilities to automate and streamline data collection enabling teams to efficiently gather, validate, and report on third-party risk information."). **Related tasks** * [Assign TPRM roles to users and user groups](https://www.servicenow.com/docs/i9W52CXiOEPircWhdSPUBA "Assign roles to users before you implement or use the Third-party Risk Management application. Assigning roles in a well-organized manner simplifies and improves process management and helps to ensure that users are promptly notified of tasks in their areas of responsibility.") **Related reference** * [Roles installed with Digital resilience third-party registers](https://www.servicenow.com/docs/TtrkPs6poHQTDG1t0pV9rw "Specific roles are installed with Digital resilience third-party registers.") * [Roles in Smart Assessment Engine](https://www.servicenow.com/docs/X4P67YEOrXRTfAyzEE13iA "Roles determine the permissions and access in the Smart Assessment Engine application.")