Assess risk
Open a vendor to see where its risk stands. SolveGRC scores risk from what it knows about the vendor: the AI-evaluated questionnaire, eligible OSINT signals, independent evidence, financial health, and contract analysis. You read that risk on the vendor's detail page and, for the serious vendors, push it into the enterprise risk register.
Residual risk and posture
The Overview item includes the Residual Risk & Posture card, which leads with the vendor's residual risk. SolveGRC frames it as reliance × posture: how much you depend on this vendor (its criticality), combined with how strong its security posture looks. The posture card shows:
- a composite posture score,
- an assurance coverage bar (how well-sourced that posture is), and
- a breakdown by source: questionnaire, external signals, evidence, financial, and contract.
The card's real value is the callout it raises when you rely heavily on a vendor but have thin assurance to back it up. That combination, high reliance and low assurance, is exactly where third-party risk hides.
Risk isn't something you calculate by hand here. It's derived from the AI-evaluated questionnaire, eligible OSINT signals, independent evidence, financial health, and contract analysis, then rolled up into the posture and residual bands. If assurance coverage is below a floor set by the vendor's criticality, the band shows Unknown. Add more of those inputs and the picture sharpens.
If your own judgment differs from the computed posture, you can override it with a required reason. The card then shows your manual band alongside the computed one, marked Overridden, so the override is always visible. The Scores item shows the same Overridden badge.
Assessment history
The Assessments item lists the vendor's scored assessments: the inherent score, the residual score, and control effectiveness. Scores sit on a 0 to 100 scale banded into low, moderate, high, and critical.
Explain the risk in words
The AI Narrative item generates an AI risk narrative in one of three forms: Executive Summary, Technical Analysis, or Audit Report. It pulls from the vendor's findings, latest assessment, high-risk questionnaire answers, evidence freshness, and drift, and writes an audience-appropriate summary. Findings, the latest assessment, and flagged answers appear as numbered citations back to the source records. You can copy it or export it as Markdown.
Escalate to the risk register
When a vendor is genuinely material, promote it to your enterprise risk register. The Escalate to Risk button appears on the vendor header for high or critical vendors, or when there are open high or critical findings, and you need permission to create risks to use it. It opens Escalate to Risk Register, pre-filled with the vendor's severity and domain. Submitting it creates a risk signal on the Risks Signals tab, not a register entry. The risk team then links the signal to an existing risk or creates a new one (see Promote from signals).
Individual findings can be escalated the same way, and a finding can instead be formally risk-accepted with an expiry date. Both are covered on Review and findings.
Knowing a vendor's risk, the next move is usually to ask it the hard questions directly. Continue to Send an assessment.