Review and findings
Once a vendor submits, your team reviews the answers and the evidence behind them, then turns any gaps into tracked findings you can remediate.
Review the submission
Open the assignment and use the Responses view to read what the vendor sent, answer by answer, alongside any evidence they attached. The Evidence Review area is where you work through vendor-supplied files: flagged or quarantined evidence, AI-suggested mappings from answers to your controls, and false-positive handling.
When the vendor submits, SolveGRC runs an AI evaluation of the answers automatically and shows the result on the AI Risk Analysis card. If you need to run it yourself, click Run AI Evaluation or Re-evaluate Responses. In Review Responses, mark each answer Approve, Reject, or Request Clarification. The assignment stays Submitted after your review. Nothing moves it to a later status.
Turn gaps into findings
From a reviewed assignment, Generate Findings from Gaps surfaces the answers that need attention (rejected, needing clarification, or flagged high-risk by the AI) and proposes a severity for each. You pick which ones to turn into findings, adjust the severity, and for the serious ones you can tick Escalate to Risk in the same step.
The findings hub
Every finding across your vendors lives in the Findings hub, with cards for open findings, critical and high findings, and SLA status, plus filters and a table.
Findings can also come from a vendor's AI Suggestions item: click Draft finding on a suggestion, then accept it. There is no screen for creating a finding by hand.
Work a finding
Open a finding to see its number, severity, status, and SLA due date (SolveGRC sets the due date from the severity: the more severe, the sooner). Once a day, an open finding past its due date is flagged SLA Breached; its status does not change and no alert is sent. The detail view has three tabs:
- Details with the description and a remediation plan.
- Comments, a threaded discussion with @mentions and an internal-only or vendor-visible toggle.
- Timeline, the full audit trail.
Advance a finding through its lifecycle with the status control (open, in progress, remediated, closed, and so on). SolveGRC enforces which transitions are allowed, so you can't jump to an invalid state.
Accept or escalate the risk
Not every finding gets fixed. Two other outcomes are built in:
- Escalate to Risk promotes the finding into the enterprise risk register as a signal the risk team can correlate and quantify.
- Risk acceptance formally records a decision to accept the finding, with a business justification, any compensating controls, and a required future expiry date, since acceptances aren't allowed to be perpetual. On that date the acceptance becomes Expired and the finding reopens.
A risk acceptance moves through request and approval steps. SolveGRC blocks you from approving a risk acceptance you requested, so someone else has to approve it.
Findings cover what a vendor told you. Contracts cover what it committed to. Continue to Contracts.