Take a vendor from onboarding to monitoring

This workflow takes a new third party from a name on a list to a vendor you have assessed, rated, reported on, and keep watching. It crosses Third-Party Risk (TPRM), the vendor portal your vendor uses, the Evidence Library, and the Risk Register.

You are done when the vendor has a confirmed criticality, a reviewed questionnaire, findings for what fell short, a risk rating, and a finalized memo, and its serious issues sit in the Risk Register's signal queue.

Before you start

• The vendor's details. Its legal name, website, and a contact email for the person who will answer your questionnaire.
• A questionnaire. Start from a template on the Assessment Templates page (Use template makes a questionnaire from it), or build your own.
• Permissions. Escalating to the Risk Register needs permission to create risks.
• Plan limits. Starter plans allow 25 vendors and Professional plans 100; Enterprise has no cap.

The dashboard's Manage vendor risk goal covers stages 1 to 5 in brief.

1. Add the vendor

On the Vendors page, click Add Vendor. In Add New Vendor, only Legal Name is required. You can also bring a vendor in through Intake Requests: someone files a New Request, and when a reviewer clicks Approve, the vendor is created. A requester cannot approve their own request.

You're done when the vendor appears in the vendor list.

Details: Onboard vendors.

2. Confirm its criticality

Open the vendor. SolveGRC suggests a criticality tier from its profile: what the vendor does, its sector, and whether it touches payment, health, personal, or privileged data. Payment processors and identity providers start at Critical. Until someone confirms it, the suggested tier replaces whatever you picked when you added the vendor.

On Overview, use the Criticality Assessment card: Build profile, choose a tier in Confirm as, and click Save & confirm.

Criticality drives the vendor's residual risk band, when an assessment counts as stale, and whether Escalate to Risk is offered. Vendors rated Medium or above also get a draft Supply-Chain Attestation assignment, due in 30 days.

You're done when the card shows Confirmed.

3. Send the questionnaire

On the Vendor Questionnaire Assignments page, click New Assignment. In Issue Questionnaire, pick the Vendor and the Questionnaire, give it an Assignment Title, tick Send to vendor immediately, enter the Vendor Email, and click Create & Send.

The vendor gets an invitation to the vendor portal. It works once and expires after 14 days. If the email does not arrive, the invite dialog shows a Secure invitation link you can send yourself; resending cancels the old link. Use Send Reminder on the assignment page to nudge the vendor.

You're done when the assignment shows Sent.

Details: Send an assessment.

4. The vendor answers

The vendor signs in to the vendor portal, answers one question at a time or in Section view, and attaches files where asked (up to 50 MB each, 10 per answer). Answers save as they type. They sign and submit, and get a Confirmation Number. Vendors never see your findings.

Every file a vendor uploads is registered in your Evidence Library automatically and scanned for malware. A file the scan flags goes to Evidence Review, where you can approve an override, rescan, mark a false positive, or delete it.

You're done when the assignment shows Submitted.

This hands on the vendor's answers, and their files as evidence.

Details: Vendor portal.

5. Review the answers and raise findings

SolveGRC evaluates the answers with AI as soon as the vendor submits; the result appears in the AI Risk Analysis card. If it is missing, click Run AI Evaluation.

Open Review Responses and mark each answer Approve, Reject, or Request Clarification. Then, on the assignment's Findings tab, click Generate Findings from Gaps. It proposes findings from rejected answers, answers needing clarification, and answers the AI rated high or critical risk. Critical and High gaps come with Escalate to Risk already ticked. The vendor's AI Suggestions item can propose more (Draft finding).

Findings get a remediation deadline from their severity; Info findings have none. A finding past its deadline is flagged SLA Breached overnight. If you decide to live with a finding, Accept Risk opens Request Risk Acceptance, which someone other than you must approve. On its expiry date the acceptance expires and the finding reopens.

You're done when the vendor's findings appear in the Findings hub. The assignment itself stays Submitted.

Details: Review & findings.

6. Read the risk rating

The Residual Risk & Posture card on the vendor's Overview combines the vendor's posture with its criticality. Posture comes from the AI-evaluated questionnaire, external signals, independent evidence, financial health, and contract analysis. If too little of that is in, the band reads Unknown rather than guessing.

You're done when the card shows a residual band you can explain from its inputs.

Details: Assess risk.

7. Escalate what matters

For a serious finding or a high-risk vendor, click Escalate to Risk. It opens Escalate to Risk Register and sends a signal to the Risks Signals tab, not a finished risk. Every five minutes SolveGRC tries to match queued signals to an existing risk and links a strong match. Otherwise the risk team links the signal or creates a new risk, which starts as Draft.

To put your riskiest vendors straight onto the register, use Send to risk register on the TPRM dashboard's Top Risky Vendors card. It creates or refreshes risks for your top 10 vendors.

You're done when the signal is on the Signals tab, or linked to a risk.

Details: Promote from signals.

8. Report out

On the Memos page, click Generate Memo and pick a type in Generate Risk Memo: Vendor Deep-Dive for one vendor, or Quarterly Board Report, Monthly Executive Summary, or Event Response Memo for a wider view. A memo cites only records captured when it was generated. Click Submit for Review, then Finalize to lock it, and Export report for PDF, Word, HTML, or Markdown.

You're done when the memo shows Finalized and you have exported it.

Details: Report out.

9. Keep watching

Some monitoring runs on its own and some you start:

• Daily. Drift detection and reassessment scoring run every day. The Reassessment Queue on the OSINT dashboard ranks vendors that are due; click Schedule to create a draft assessment, or Defer. Nothing sends a reassessment without you.
• Weekly. Every Monday SolveGRC collects external signals for every vendor with a known domain (its website or a contact email). Click Run OSINT now on the vendor's Intelligence item to collect sooner. Signals appear on the vendor's OSINT Signals item.
• Contracts. Every Monday the vendor's contract deadlines are recalculated and listed under Upcoming Obligations & Deadlines on its Contracts item.
• Your calendar. Next Review Due on the vendor is a date you set.

You're done when you have a date for the next review and the vendor has a website or contact email, so its signals are collected each week.

Details: Monitor.