By role · Third-Party Risk Manager
You send the questionnaire. The calendar chases it.
Vendors answer without an account, templates spawn every round and recurrence raises the next assessment on its own. What is left for you is the overdue list, worked from a pipeline rather than a memory.
What this replaces
- Procurement onboarded the vendor and the spreadsheet stopped there.
- Questionnaires go out as attachments and come back to whoever opens the reply.
- A late annual reassessment surfaces when the customer audit asks about it.
What you do here
- 1Hold the vendor record, not procurement's sheet.Contacts, contracts and the service each vendor actually provides sit on one record, updated where the assessments live.Vendor register
- 2Send an assessment the vendor answers without an account.One link, one questionnaire, no vendor portal to provision. The reply lands scored against the vendor record.Vendor questionnaire
- 3Template the questionnaire once.Spawn every assessment from it, then compare rounds side by side to see whether a vendor actually improved.Questionnaire templates
- 4Fix the reassessment interval per vendor.Quarterly, semi-annual or annual: recurrence raises the next round without anyone remembering the anniversary.Reassessment policy
- 5Clear the overdue assessment list.The pipeline view shows what stalled and where; a whole cohort takes one bulk action instead of twenty reopenings.Assessment pipeline
- 6Answer the questionnaires your own customers send.Inbound requests land in the same module as outbound ones, so last quarter's answers are already written down.Inbound TPRM
What changes
- Every evidence file logs its upload, its download and its audit trail.
- Two reports, one dataset: a single vendor, or the whole portfolio.
- Portfolio trend and the overdue list sit in the TPRM analytics tab, a licence-gated add-on.
Vendor registerVendor questionnairesAssessment pipelineReassessment policyVendor evidenceInbound TPRMPortfolio report
Where the role stops
Vendors, assessments and their evidence are yours to change. The risk register those scores land in is one you feed, never one you hold; compliance is read-only too.
Works with
- Risk ManagerSpreadsheet registers miss the connections. Set the scoring methodology once, then let every entry hold the controls, processes, incidents, KRIs and vulnerabilities it actually touches, with treatment plans and formal acceptances on the record.RISK
- Data Protection OfficerA regulator's question should be answerable from the register itself. Article 30 entries, DPIAs, consent records and processors sit in one dataset, with data subject requests broken into tasks. Seeded in the platform as Privacy Officer — the same job under the US title.GDPR
- Compliance OfficerMap one control to several frameworks, take the audit cycle from scope to certificate upload, then close each finding against a verify step instead of an opinion.COMPLIANCE
Ready to move
beyond legacy GRC?
14-day free trial. No credit card. Cloud or on-premises.