Third-party (external) risk assessment management

After the IRQ process is complete, you send questionnaires and document requests to the third-party contact. You manage the third-party risk assessment by working with the contacts to help ensure that the responses are complete and accurate.

Accessing an external assessment

On the Due diligence management page, select the DDR number for any engagement due diligence request and the select the External assessments tab. The tab displays the list of all third-party risk assessments (external due diligence processes) for the selected engagement request.

Working on a third-party risk assessment

For each external risk assessment, the system auto-assigns a unique ID number that starts with the text VRA. A risk assessment can represent the work on an engagement request for a third-party organization or an engagement request for a group within the parent organization. Select a VRA number to work on the risk assessment on the External assessments tab.

Actions on any tab

Table 1. Actions

Action	Description
Discuss	Select Discuss to send a message to other users. The message is recorded in the Activity section of the Details tab.
Create	Create an issue or task as describe in the following sections.
Save	Select Save to save any change you made to a value on any tab.
Submit to third party	Submit all questionnaires and document requests to the TP contact. The action is recorded in the Activity section on the Details tab.
… Delete	Select Delete to delete the record of the engagement request.
Adding an attachment	Select Browse in the Attachments section or select the attachment icon to select and add an attachment.

Working on third-party risk assessments

Risk overview tab on the External assessments page

• The symbols indicate the current state of the external assessment process for the engagement request. See External assessment lifecycle states for descriptions of the states.

  

• Overview section: List of assessments that are associated with the engagement.
• Questionnaires and document requests section: List of questionnaires and document requests for the engagement.
• Fourth-party questionnaires section: List of questionnaires and document requests for fourth parties and their sub-parties that are associated with the engagement.
• Tracking section: Count of assessments associated with the third party that are in the Open, Overdue, and Closed status.

Details tab on the External assessments page

• Third-party risk assessment section: General information on the third party plus schedules for the overall assessment and questionnaire due dates from the engagement due diligence request.
• The Compose section on the Details tab enables you to permanently add text to the record. The Activity section is updated with any actions on issues and tasks, submissions to TP contacts, and also with work notes and comments that users add to the record. Add text in the following fields as needed:

  • Work notes (Private): Information about the third-party risk assessment. Work notes are visible only to internal users who are assigned to the process.
  • Comments: Comments about the third-party risk assessment are visible both to internal users and to third-party contacts.

Questionnaire templates tab on the External assessments page

The tab lists the questionnaires that the third-party contact will respond to. Select a name to view the details. For more information, see Create a questionnaire or document request template and Create a questionnaire or document request template using the Designer.

To enable TPR assessors to modify responses, configure the Allow TPR assessors to modify responses in third-party questionnaires [sn_svdp.allow_assessor_edit] system property. You can set the following options:

• Enable TPR assessors to answer questions or modify responses (default)
• Enable TPR assessors to modify responses
• Do not enable TPR assessors to answer questions or modify responses

See Configure TPRM properties.

Document templates tab on the External assessments page

The tab lists the requests for documents that the third-party contact should return. The information in the columns helps you to prioritize your work in following up with third-party contact. In particular, the state and percent complete values are key indicators. Select a name to view the details. For more information, see Create a questionnaire or document request template and Create a questionnaire or document request template using the Designer.

Fourth-party templates tab on the External assessments page

The tab lists the fourth-party questionnaires that the third-party contact will respond to. Select a name to view the details. For more information, see Monitoring your fourth-nth parties.

Third-party risk areas tab on the External assessments page

A risk domain defines the type of risk to assess for a third party. For example, you might want to assess a data-management third party in terms of security risk and a bank in terms of financial risk. Security risk and financial risk are risk domains. Some platform applications refer to risk domains as "risk areas." See Define a third-party risk domain.

Issues tab on the External assessments page

In an iterative process, before the TPR manager closes an assessment, the TPR manager can generate non-compliance issues and tasks. The TPR manager communicates with the TP contacts and engagement contacts by using comments to close the issues and tasks. The TPR manager can also assign different contacts as needed. See Create an issue for a third party or engagement and Manage issues.

Tasks tab on the External assessments page

In an iterative process, before the TPR manager closes an assessment, the TPR manager can generate non-compliance issues and tasks. The TPR manager communicates with the TP contacts and engagement contacts by using comments to close the issues and tasks. The TPR manager can also assign different contacts as needed. See Create a task for a third party or engagement and Manage a task for a third party or engagement.

• External assessment lifecycle states
  The process of collecting assessment data from a third party moves through several states. For example, during the Submitted to third party state, the third party responds to tasks, issues, and works to complete the questionnaires.
• Assessment metric type form
  Use the assessment metric type form to capture all the information that you need to create a questionnaire template using the Third-party Risk Management application. As a third-party risk admin, you can create a questionnaire template.
• Create new external assessment template form
  Use the external assessment template form to capture all the information that you need to create an external assessment template. As a third-party risk manager, you can create an assessment template.
• Create New TPRM SAE questionnaire template form
  Use the Create New TPRM questionnaire template form to capture all the information that you need to create a TPRM SAE questionnaire template using the Smart Assessment template designer. As a third-party risk admin, you can create a questionnaire template.
• Third-party risk assessment form
  Use the third-party risk assessment form to capture all the information that you need to create an assessment using the Third-party Risk Management application. As a third-party risk assessor or manager, you can create an external assessment.
• Third-party element form
  Use the third-party element form to capture all the information that you need to create a third-party element record using the Third-party Risk Management application. As a third-party risk manager, third-party risk assessor, or due diligence request owner, you can create a third-party element record.

Related concepts

• External assessment lifecycle states

Related tasks

• Define a third-party risk domain
• Manage issues
• Manage a task for a third party or engagement

Related reference

• Assessment metric type form
• Third-party risk assessment form
• Third-party element form