Report out
The last stage is turning everything you've gathered into artifacts other people can use: AI-written memos for stakeholders, data exports for auditors, and a dollar-quantified view of vendor risk pushed into your enterprise register.
Risk memos
Open Risk Memos and click Generate Memo to open Generate Risk Memo. Pick a type: Quarterly Board Report, Monthly Executive Summary, Vendor Deep-Dive, or Event Response Memo. SolveGRC gathers your vendors, findings, assessments, questionnaire assignments, drift, and acceptances, then writes the memo with numbered citations. Citations can point only at a snapshot of the source records, and the result of an integrity check is stored with the memo.
A memo starts as a draft you can edit. Click Submit for Review to move it to review, then Finalize to lock it. Export report downloads the memo as PDF, Word, HTML, or Markdown at any status.
Exports for auditors
The Exports tab on the Evidence Review page produces downloadable reports: Evidence Inventory, Chain of Custody, False Positive Report, Scan Results Summary, and Complete Audit Package. Reach for these when someone asks you to show your third-party risk work.
Quantify vendor risk in dollars
Beyond escalating individual vendors, SolveGRC can promote your top vendors into the enterprise risk register as dollar-quantified risks. On the TPRM dashboard, click Send to risk register on the Top Risky Vendors card to create or refresh register risks for your top 10 vendors. SolveGRC derives loss inputs from each vendor's residual band and criticality, then runs the same Monte-Carlo engine the rest of the platform uses to produce an expected annual loss per vendor and a portfolio total. This turns "this vendor is high risk" into a number the business can weigh.
Settings
TPRM Settings is where you configure module behavior. It has five tabs: Evidence, Security, Notifications, Benchmarking, and Thresholds. The two to know first are Evidence (retention policies, malware scanning, and notifications) and Benchmarking (whether your organization opts in to anonymized benchmarking).
That's the full vendor lifecycle, from onboarding a third party through to quantified, reportable risk. Start again at the Overview for the map, or jump to any stage from the sidebar.