---
sourceDocument: Zurich Governance, Risk, and Compliance
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/governance-risk-compliance

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Governance, Risk, and Compliance

ft:clusterId :

    - grc

bundleId :

    - grc

workflow :

    - Technology


---

# Approve or reject due diligence requests

# Approving or rejecting requests for due diligence {#ariaid-title1}

Release version: Zurich  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 6 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Approving or rejecting requests for due diligence

The Third-party Risk Management (TPRM) application in ServiceNow enables you to set up and manage approval levels and rules for due diligence requests.
This process ensures that the right team members review questionnaire responses, supporting documents, and due diligence results before approving or rejecting requests.
Approval decisions are based on the risk rating and other engagement details, facilitating a structured and controlled risk assessment workflow.
Show full answer Show less  

## Setting up Approval Levels and Rules

Administrators or users with the Third-party risk (TPR) admin role can configure up to 10 approval levels, each containing multiple rules with filter conditions to assign approvers according to engagement risk ratings, location, or other criteria. For example, different approvers can be assigned for low, medium, and high-risk engagements, and multi-level approvals proceed sequentially, with rejection at any level halting the process.

The default configuration includes three approval levels with predefined rules, but you can customize or replace these settings to fit your organization's requirements. Multi-level approvals integrated with workflows require updates via Workflow Studio.

## Approving Due Diligence Requests

After all assessments are closed, the due diligence request enters the "Ready for TPRM approval" state. The TPR manager or assessor verifies assigned approvers and requests approval, triggering notifications to approvers. Approvers, who must belong to the TPR manager user group, review all relevant questionnaire responses, supporting documents, and risk intelligence scores using either Vendor Management Workspace or the VRM Classic interface.

Approvers can access their pending tasks and approvals via the Task page and either approve or reject requests. If approved, the due diligence request is closed, and the third party's status is updated to Active. If contract preparation is needed, the request moves to the Contract Risk Process and assigns a contract negotiator automatically.

## Rejecting Due Diligence Requests

If issues cannot be resolved or the request is canceled, approvers can reject the due diligence request with comments explaining the reasons. This updates the request state to Rejected and notifies all stakeholders. The owner can reopen the approval process by providing a justification, enabling reconsideration after addressing concerns.

## Practical Benefits for ServiceNow Customers

* Enables structured, multi-level due diligence approvals tailored by risk and geography.
* Integrates approval workflows with notifications and task management for efficient processing.
* Provides clear audit trails and comments for both approvals and rejections, enhancing transparency.
* Supports proactive risk management by linking due diligence outcomes to contract negotiation processes.  
Set up the approval levels and rules for due diligence requests in the Third-party Risk Management application to use while approving or rejecting requests after reviewing questionnaire responses and due diligence process results.

## Approval process overview {#tprm-approving__section_kdz_yb2_fbc}

Approval levels and rules are used to determine which team members are assigned as approvers to the due diligence request. During the approval process, approvers review the external questionnaire responses and supporting
documents that were provided by the third-party contact. They also consider any other information that was gathered during the due diligence process. Approvers can approve or reject due diligence requests based on the
information reviewed.

For more information on managing approvals, approval levels, and approval rules, see [Approval process management](https://www.servicenow.com/docs/aa2ga8JH2tWOq1qeexpkyw "You can view the list of users who can approve or reject a DD request and also view the details of their approval actions. In addition, you can view the approval levels for a request.").  
Note:  
Any multi-level approvals related to a workflow require updates to be made using Workflow Studio. For more information on creating flows using Workflow Studio, see [Create a flow in Workflow Studio](https://www.servicenow.com/docs/access?context=create-flow&version=zurich&pubname=zurich-build-workflows&ft:locale=en-US).

## Setting up approval levels and rules {#tprm-approving__section_pdt_kcc_1bc}

You must have the admin or Third-party risk (TPR) admin \[sn_vdr_risk_asmt.vendor_risk_admin\] role to create approval levels and rules for due diligence requests. You can create up to 10 different approval levels that each
contain different approval rules. Within each approval level, you can assign one or more rules with different filter conditions that apply to the assigned approvers. For example, you can assign different approvers to the due
diligence request based on the engagement's risk rating and location.

With the Third-party due diligence default configuration, you can create three records with approval levels 1, 2, and 3. Level 1 has three rules, level 2 has two rules, and level 3 has two rules. The following example shows
how you would assign these rules with filter conditions:  
* Level 1
  * Rule 1: User A and User B are assigned to approve the engagement's low risk rating.
  * Rule 2: User C and User D are assigned to approve the engagement's medium risk rating.
  * Rule 3: User E and User F are assigned to approve the engagement's high-risk rating.
  {#tprm-approving__ul_fnk_wld_r1c}
* Level 2
  * Rule 1: TPR manager is assigned to approve the engagement in Asia/Pacific.
  * Rule 2: TPR manager is assigned to approve the engagement in Europe/North America.
  {#tprm-approving__ul_m4g_fmd_r1c}
* Level 3
  * Rule 1: All TPR administrators are assigned to approve an engagement in a specific region that has a high-risk rating.
  * Rule 2: All TPR administrators are assigned to approve an engagement in a specific region that has a very high-risk rating.
  {#tprm-approving__ul_fjt_pmd_r1c}
{#tprm-approving__ul_vfn_vld_r1c}  
During the approval process, level 1 is triggered first. If all assigned users approve the conditions in level 1, then level 2 is triggered and so on. If any assigned user in level 1 has rejected the due diligence request, level 2 isn't triggered and the due diligence request is rejected. For more information on possible rating definitions, see [Set up risk rating scales for scoring](https://www.servicenow.com/docs/PVWn_1DimU9RDSOOjqkdhg "The risk rating scale helps business users better understand risk assessment results. For example, in the default settings, risk scores in the 20 through 39 range indicate high risk, while scores in the 60 through 79 range indicate low risk.").  
Note:  
You can use the Third-party due diligence default configuration included as part of the base system or deactivate the default configuration and create an approval configuration that applies to a different table. For more information, see [Set up an approval configuration record](https://www.servicenow.com/docs/19aIt4MMqYbe4mkHutMo3Q "Set up an approval configuration record to enable multiple levels of approvals and select approvers for each level based on approval rules.").

For more information on setting up approval levels and rules, see [Set up the approval levels for due diligence requests](https://www.servicenow.com/docs/cgmtiYEi~vi1jvssaBjBkw "Assign one or more approval levels to the users or groups that approve your due diligence requests in the Third-party Risk Management application. Because the approval levels are applied iteratively and each level contains different rules, you can help to ensure that the correct user or group is assigned as an approver.") and [Set up the approval rules for due diligence requests](https://www.servicenow.com/docs/xYshXtlwFKV7qn2NH_49~A "Set up the rules at each approval level for your due diligence requests by selecting an approver type and the number of approvals that you require in the Third-party Risk Management application. You can also filter the table conditions that apply to each rule so that you can help ensure that the correct user or group is assigned as an approver.").

## Approving due diligence requests {#tprm-approving__section_urv_rmn_nzb}

The following infographic shows the approval process.  

<br />

The due diligence request enters the Ready for TPRM approval state after all assessments have been closed. The TPR manager \[sn_vdr_risk_asmt.vendor_risk_manager\] or TPR assessor \[sn_vdr_risk_asmt.vendor_assessor\] that has
been assigned as the owner of the due diligence request verify that approvers are assigned to the due diligence request. After the assigned approvers are validated, the TPR manager or owner requests approval. The due
diligence request enters the Awaiting approval state and the system sends an email notification to all assigned approvers.

All internal stakeholders (approvers) review the external questionnaire responses and supporting documents that were provided by the third-party contact. You must be a member of the Third-party risk (TPR) manager user group
to approve requests. Approvers perform all actions by using Vendor Management Workspace or VRM Classic user interface. Approvers can view all of their pending My approvals, Tasks, and Issues by navigating to
the Task page.

To view the Task page in the Vendor Management Workspace, select WorkspacesVendor Management Workspace. Then, select the task icon ![]().

To view your assigned approvals, select My approvals.

To view My approvals in the VRM Classic user interface, navigate to AllSelf-ServiceThird-party Risk ManagementDue Diligence RequestsMy Approvals.  
From this view, you can accomplish the following tasks:

* Review the internal questionnaire responses. Navigate to the Due diligence request record page by selecting the Due Diligence Request (DDR) number and then selecting the Internal assessment (INA) number on the
  Internal assessments tab. For more information, see [IRQ process management](https://www.servicenow.com/docs/mPyZpEnDphvi94mcgRNzWg "The first internal step after an engagement request is approved is to start the IRQ process to scope the risk by determining the third party's risk score.").

* Review the risk intelligence scores.Navigate to the Due diligence request record page by selecting the DDR number and then selecting the Risk intelligence scores tab. For more information,
  see [Viewing risk intelligence scores](https://www.servicenow.com/docs/H_izyHjk~Z4tShKYjpz4_w "For DD requests, risk intelligence scores appear in a list. For an individual third party, a card displays the most recent score or rating and a link for each risk intelligence report.").

* Review the external questionnaire responses and supporting documents. Navigate to the Due diligence request record page by selecting the DDR number and then selecting the External assessment (VRA) number on the
  External assessments tab. For more information, see [Third-party (external) risk assessment management](https://www.servicenow.com/docs/OXood1Zz6~1qAMFX1iOAfA "After the IRQ process is complete, you send questionnaires and document requests to the third-party contact. You manage the third-party risk assessment by working with the contacts to help ensure that the responses are complete and accurate.").

* Access the approval request record page.Select one of the Requested states from the list to open the approval request record page. From this page, you can select Approve or
  Reject. For more information, see [Approval process management](https://www.servicenow.com/docs/aa2ga8JH2tWOq1qeexpkyw "You can view the list of users who can approve or reject a DD request and also view the details of their approval actions. In addition, you can view the approval levels for a request.").

{#tprm-approving__ul_yzq_5pg_b1c}

If the responses meet your requirements, one or more approvers approves the request, and the owner (TPR manager or TPR assessor) closes the due diligence request and the engagement. The third party or engagement state is now
Active. If a contract is going to be prepared, an approver, TPR manager, or owner selects Send to contract negotiator and assigns a contract negotiator. The state of the
approved due diligence request is updated to Contract Risk Process and the contract risk negotiator is notified through an automated email. For more information, see [Managing the contract risk process](https://www.servicenow.com/docs/86emnHXqbrnasQlGnewwiA "Protect your organization's interests, as the Third-party risk contract negotiator, often the corporate counsel, by incorporating specific contractual provisions so that you can address the risks identified using the Third-party Risk Management application.").  
Note:  
This topic covers due diligence request (DDR)-level approval and rejection, which happens after all assessments in the request are closed. To review and follow up on individual question responses while an assessment is still in progress, including flagging unsatisfactory responses for a third party or engagement contact to update, see [Smart assessments with Third-party Risk Management](https://www.servicenow.com/docs/Q52T_dPhubHzBEpI23QheA "With the integration of Smart Assessment Engine (SAE), TPRM now supports both the Classic assessment engine and SAE. You can create questionnaire templates and add instructions, questions, and reference information by creating templates using SAE in the Vendor Management Workspace.").

## Rejecting due diligence requests {#tprm-approving__section_fbz_5ms_11c}

If an issue can't be resolved or the due diligence request is canceled, the approver can reject the request and enter comments. To view your My approvals, navigate to the task page, select My approvals, and then select a Requested state from the list to open the approval request record page. From this page, you can select Reject to reject the request.

After the due diligence request is rejected, the following actions occur:

1. The state of the due diligence request is updated from Awaiting approval to Rejected.
2. The approver enters an explanation for rejecting the due diligence request in the Comments field.
3. The Due diligence process state is updated to Rejected and all stakeholders are notified that the engagement has been rejected.

{#tprm-approving__ol_b42_hjt_hkc}  
Note:  
The owner can reopen the approval process by selecting the due diligence request from the All request list. The owner must provide a justification for restarting the approval process.

*[\>]: and then