The vendor risk assessor creates an assessment, initiating the vendor risk assessment life cycle. Vendor risk assessments can be created on-demand or from a repeating assessment. When creating an on-demand vendor risk assessment, select the questionnaire template or document request template, and the vendor. Also, vendor risk managers can select multiple vendors at a time and automatically trigger vendor risk assessments.

1. Navigate to Vendor Risk > Assessments > All Assessments.
2. Click New.

   

3. On the form, fill in the fields.

   Table 1. Vendor Risk Assessment form

   Field	Description
   Name	The name of the vendor risk assessment.
   Description	A more detailed explanation of the issue.
   Number	Read-only field automatically populated with a unique identification number.
   Applies to	Select Vendor or Engagement.
   Engagement	Select the engagement being assessed. This field is visible only if you selected Engagement from the Applies to field.
   Repeating assessment	The assessment used to create the current assessment.
   Assessment template	If you want to use one assessment template to create questionnaires or document requests for this assessment, select the one you want to use. If you want to use multiple templates to create multiple questionnaires or document requests for this assessment, leave this field blank.
   Owner	The owner of this assessment.
   State	Draft Submitted to vendor Closed Canceled
   Risk rating	The overall risk rating for this vendor. Critical High Moderate Low Minor Note: The Risk rating is determined by finding a risk rating scale range in which the risk score falls. It defines how a minimum and maximum range of assessment scores maps to a qualitative risk score.
   Risk rating valid to	The date the risk rating expires. This date must be later than the Risk rating valid to date on any associated questionnaires or document requests.
   Trigger by vendor tier	Initiate this assessment when the vendor tier changes.
   Watch list	Add users to be notified when this record is modified.
   Risk Scoring
   Computed risk rating	Shows an average of the vendor risk area risk ratings.
   Override risk rating	Allows you to override the computed risk rating for the vendor. When checked, any future changes made to the assessment risk rating will affect only the computed risk rating, not the risk rating. If the check box is selected and then you deselect it, the computed risk rating is copied back to the assessment.
   Overridden risk rating	If you selected Override risk rating, enter the new risk rating.
   Justification	If you selected Override risk rating, you must enter a reason for the override.
   Assessment Schedule
   Planned duration (days)	Estimated duration period of the assessment
   Planned start date	Planned start date and time for work on the vendor risk assessment.
   Planned end date	Planned completion date and time fort work on the vendor risk assessment.
   Created by	Shows the user who created this record.
   Created	Shows the date/time the record was created.
   Actual duration	The amount time it took to complete the vendor risk assessment. This field is calculated using the Actual state date and Actual end date.
   Actual start date	Date and time that work on the vendor risk assessment began.
   Actual end date	Completion date and time for the vendor risk assessment.
   Updated	Shows the date/time when the record was last updated.
   Questionnaire Schedule
   Planned duration (days)	The amount of time given to the vendor for completing the vendor risk assessment. This field is calculated using the Planned state date and Planned end date.
   Review duration (days)	The review duration given to customer to review all the questionnaires.
   Due date	Deadline for vendor to answer all the questionnaires.
   Completion date	The actual date when vendor completed all the questionnaires.
   Submitted to vendor	The delivery date for vendor questionnaires.
   Resubmitted to vendor	The date questionnaires are resent to the vendor.
   Responses expected by	The date the vendor is expecting the responses.
   Notes and Comments
   Work notes	Information about the vendor risk assessment. Work notes are visible to users assigned to the issue.
   Additional comments (Customer visible)	Public information about the vendor risk assessment.

4. Save the record. Additional related lists appear.

   

5. If you left the Assessment template field blank and want to use assessment templates to associate multiple questionnaires and/or document requests with this assessment, scroll down to the Questionnaires or Document Requests tabs.
6. To associate existing questionnaires and/or document requests with the assessment, perform the following steps.
   1. Click the Questionnaires or Document Requests tab, depending on the type of questions you want to associate with the assessment.
   2. Click Edit.
   3. Select the questionnaires or document requests you want to use, then click Save.
   4. Repeat for the other type of questions, if needed. That is, if you associated questionnaire templates to the assessment and also want to associate document request templates, click that tab and repeat these steps.
7. To create new questionnaire and/or document request templates and associate them with this assessment, see Manually define a questionnaire template or document request template.
8. Click Submit to Vendor.
   The state of the assessment changes to Submitted to Vendor, the templates you selected automatically generate questionnaires and/or document requests, and the primary vendor contact receives an email notification, along with a link to the assessment in the Vendor Portal.
9. When the vendor contact is ready to respond to the assessment, he or she clicks the email link to open the assessment in the Vendor Portal.
   Note: As you can see, one of the questionnaires shown above requires a signature. The vendor or reviewer must save and e-sign the questionnaire or document request before it can be returned to the vendor risk assessor. For more information, see Approve questionnaire assessments or document requests with e-signatures.
10. The vendor assessor moves the state of the assessment to Generating Observations. During this time, the vendor assessor can click the View Response link in the document requests/questionnaires related list to view the response and provide comments or change responses, as necessary.
    For any problems that rise, the vendor assessor creates an issue to track the remediation process (Finalizing with vendor).
11. The vendor assessor moves the assessment to Closed state.
    The vendor risk assessor works with the vendor through the vendor portal to close the assessment.

    

Vendors use the vendor portal to complete assessments and collaborate with the vendor risk manager through the comments section.

1. Navigate to Vendor Risk > Assessments > My Open Assessments.
2. Open an assessment in the Responses Received state.
3. In the Questionnaires or Document Requests tabs, click View Responses.

   

4. Add comments to the questions and make the following selections, as necessary:
   • Select Show Follow-ups.
   • Select Show incorrect and un-scored responses.
   • Select Hide comments.
   • Select Include this question when creating an issue.
   • Enter information in the Internal comment .
   • Select Comment for vendor and add information.
5. After adding comments, perform one of the following:

   Option	Description
   To generate issues associated with each question	Click Create Issue. Note: A message with the issue number displays: The issue VRI0003001 has been created successfully.
   To resubmit the assessment to the vendor	Click Return to Vendor Note: If the assessment schedule might be impacted, you can extend the days by adjusting the number in the following message window:

Starting in Version 10.1, the Vendor Assessment Portal restricts assessment information available depending on the type of contact accessing the portal. New capabilities are available to primary and secondary contacts.

1. Log in to the vendor assessment portal through https://myCompany.service-now.com/svdp. The Assessment Summary dashboard opens.

   

2. Vendor and engagement contacts (both primary and secondary) can view assessment information in the following ways.
   • Since engagements are services or products associated with (or offered by) the vendor, engagement contacts cannot view the assessments in the Vendor section. They can view only assessments in the Engagements section.
   • Primary vendor contacts and primary engagement contacts can assign new primary contacts from the dashboard. For example, the primary engagement contact can assign another user as a primary engagement contact. If needed, both primary engagement contacts can then be assigned to complete the engagement assessment.

     

   • Primary vendor and engagement contacts can manage their teams, adding and removing contacts, and assigning primary and secondary contact designations.

     

     

   • The following diagram summarizes the capabilities of each of the contact roles.

     

   Note: If a Secondary Vendor Contact is also assigned the Secondary Engagement Contact role, that individual can take engagement assessments, but cannot take vendor assessments. In that situation, the Secondary Engagement Contact role takes precedence.

After submitting an assessment, the vendor contact can view all responses in read-only mode on the vendor assessment portal.

1. Log into the vendor assessment portal through https://myCompany.service-now.com/svdp.
2. Click through each questionnaire and view the responses.
   Note: All responses are read-only since the assessment has already been sent back to the customer.

Vendor risk assessors can create repeating vendor assessments to monitor the vendor risk continuously.

1. Navigate to Vendor Risk > Assessments > Repeating Assessments.
2. Click New.
3. On the form, fill in the fields.

   Table 2. Repeating Assessment form

   Field	Description
   Number	Read-only field automatically populated with a unique identification number.
   Description	A more detailed description of the repeating assessment.
   Name	The name of the repeating assessment.
   Assessment template	The template used to create the current assessment.
   Applies to	Select Vendor or Engagement.
   Vendor	The vendor that is being assessed.
   Engagement	Select the engagement being assessed. This field is visible only if you selected Engagement in the Applies to field.
   Active	Indicates if the current repeating assessment is active.
   Next assessment creation (months)	Next assessment will be created in specific number of months after the previous assessment is closed
   Next assessment end date (months)	The end date for the new assessment after the previous assessment is closed
   Assessment results valid duration (days)	The number of days that the assessment results are valid.

4. Click Submit.
5. The Assessment Occurrences related list displays the status of all assessments and its associated risk rating.