--- sourceDocument: Zurich Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/governance-risk-compliance Release : - zurich ft:locale : - en-US ft:publication_title : - Zurich Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # TPRM with Policy and Compliance Management # Integrating Third-party Risk Management with GRC: Policy and Compliance Management {#ariaid-title1} Release version: Zurich Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Integrating Third-party Risk Management with GRC: Policy and Compliance Management The integration between Third-party Risk Management and GRC: Policy and Compliance Management enables compliance managers to dynamically assess and update the compliance status of controls and control objectives based on questionnaire responses from third parties or engagements. This functionality helps organizations maintain accurate, real-time compliance information related to third-party risks by linking controls, control objectives, and questionnaire responses. Show full answer Show less ## Key Features * **Association of Controls and Control Objectives:** Compliance managers can associate specific controls and control objectives with questions, third parties, and engagements. This linkage applies controls to third parties or engagements, facilitating detailed compliance assessments. * **Granular Question-Level Linking:** Each question in a questionnaire template can be linked to multiple control objectives, allowing for fine-grained evaluation of compliance based on third-party responses. * **Automated Compliance Status Updates:** When third parties respond to questionnaires, the system automatically updates the compliance status of the linked controls. Incorrect answers mark controls as non-compliant, while correct answers maintain compliance. * **Entity Categorization:** All third parties are categorized as "Vendors," ensuring consistent representation as entities. Associating entities with control objectives creates corresponding controls that reflect compliance status. * **Read-only Compliance Data Consumption:** Third-party Risk Management consumes compliance objects in a read-only mode; control and control objective creation and management occur within Policy and Compliance Management. ## Practical Application for ServiceNow Customers * Compliance managers can manually add controls or control objectives to third parties, engagements, or questionnaire questions, enabling tailored compliance assessments. * Third-party risk assessors and Policy and Compliance Management users can monitor control compliance status, improving oversight of third-party risk posture. * The integration ensures that third-party compliance assessments reflect current questionnaire responses, enhancing accuracy and responsiveness in risk management processes. ## Notes * Direct mapping of control objectives to questions is not available in SAE questionnaires; however, controls can be flagged compliant or non-compliant through post-assessment actions. * Implementation and management of controls and control objectives must be done within the Policy and Compliance Management application. The GRC: Policy and Compliance Management integration updates the compliance status of controls and control objectives based on the questionnaire responses from a third party or engagement. Compliance managers \[sn_compliance.manager\] can associate controls and control objectives with specific questions, third parties, and engagements used in Third-party Risk Management. If you have the Policy and Compliance Management application installed, users with the Compliance Manager role can perform several key tasks that help manage and assess Third-party compliance. * You can associate third parties and engagements to specific control objectives. This association results in controls being applied to the third party or engagementFor more information, see [Manually add a control to a third party or engagement](https://www.servicenow.com/docs/5mklBG6puR67LpxU4mhB1Q "If you’re using both Policy and Compliance Management and Third-party Risk Management, you can associate controls with third parties and engagements. Controls can be marked as compliant or non-compliant."). * You can individually link the question to multiple control objectives for each question in a questionnaire template. This enables for a granular and detailed assessment of compliance.For more information, see [Manually add a control objective to a question](https://www.servicenow.com/docs/rKbHMWYFt6j56z_mTdWHhg "If you’re using both Policy and Compliance Management and Third-party Risk Management, you can associate control objectives and controls with questions. Controls can be marked as compliant or non-compliant based on the response to the question."). * When third parties and engagements respond to questionnaires, the system automatically updates the compliance status of the linked controls. If they provide an incorrect answer, the associated controls are marked as non-compliant. Conversely, correct answers keep the controls compliant. {#pc-assessment-integration__ul_o4d_42c_x2c} Note: Although it is not possible to directly map control objectives to questions in SAE questionnaires, SAE provides the capability to flag controls as compliant or non-compliant through post-assessment actions. All third parties are automatically categorized into an entity type called Vendors. This helps ensure that each third party and engagement is represented as an entity. When an entity, such as a third party or engagement, is associated with a control objective a corresponding control is created for that entity. This association links the third party or engagement with the control, which can influence the compliance status of the control. In the context of Third-party Risk Management, each question in a questionnaire template can be individually linked to multiple control objectives through a related list. When a questionnaire is sent to a third party and the third party responds with an incorrect answer, the controls associated with the linked control objectives are marked as non-compliant. Conversely, if the third party provides the correct answer, the controls remain compliant. This feature helps ensure that the compliance status of controls is dynamically updated based on the third party or engagements responses, providing a real-time and accurate assessment of their compliance. Both Policy and Compliance Management users and Third-party risk assessors \[sn_vdr_risk_asmt.vendor_assessor\] can monitor the status of a control. Note: Third-party Risk Management consumes compliance objects in a read-only capacity. Controls and control objectives are authored and managed in GRC: Policy and Compliance Management. For more information on implementing Policy and Compliance Management, see [Implementing Policy and Compliance Management](https://www.servicenow.com/docs/tjbtBXK2rU~zTDxs3Ts7QA "Use the steps in the GRC: Policy and Compliance Management application checklist to download the Policy and Compliance Management from the ServiceNow Store, and get it ready for operation. Mandatory and optional setup steps, as well as an implementation checklist are provided to simplify the setup."). * **[Manually add a control to a third party or engagement](https://www.servicenow.com/docs/5mklBG6puR67LpxU4mhB1Q)** If you're using both Policy and Compliance Management and Third-party Risk Management, you can associate controls with third parties and engagements. Controls can be marked as compliant or non-compliant. * **[Manually add a control objective to a question](https://www.servicenow.com/docs/rKbHMWYFt6j56z_mTdWHhg)** If you're using both Policy and Compliance Management and Third-party Risk Management, you can associate control objectives and controls with questions. Controls can be marked as compliant or non-compliant based on the response to the question. **Related concepts** * [Assessing your third-party risk](https://www.servicenow.com/docs/Irep7LZWyN_XTR9KnfuuVg "Use Third-party Risk Management to identify and assess potential risks that are associated with your third-party relationships. The information gathered from internal questionnaires, external questionnaires, and documentation requests helps you to understand the third party's risk profile, determine the appropriate risk mitigation strategies, and determine whether the third party or engagement meets all necessary compliance requirements.") * [Implementing Policy and Compliance Management](https://www.servicenow.com/docs/tjbtBXK2rU~zTDxs3Ts7QA "Use the steps in the GRC: Policy and Compliance Management application checklist to download the Policy and Compliance Management from the ServiceNow Store, and get it ready for operation. Mandatory and optional setup steps, as well as an implementation checklist are provided to simplify the setup.") **Related tasks** * [Manually add a control to a third party or engagement](https://www.servicenow.com/docs/5mklBG6puR67LpxU4mhB1Q "If you’re using both Policy and Compliance Management and Third-party Risk Management, you can associate controls with third parties and engagements. Controls can be marked as compliant or non-compliant.") * [Manually add a control objective to a question](https://www.servicenow.com/docs/rKbHMWYFt6j56z_mTdWHhg "If you’re using both Policy and Compliance Management and Third-party Risk Management, you can associate control objectives and controls with questions. Controls can be marked as compliant or non-compliant based on the response to the question.")