Minimize risk by assessing suppliers during the onboarding process

  • Release version: Xanadu
  • Updated August 1, 2024
  • 3 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Minimize risk by assessing suppliers during the onboarding process

    This integration between Supplier Lifecycle Operations and Third-party Risk Management enables ServiceNow customers to effectively identify and assess potential risks associated with new suppliers during the onboarding process. It streamlines supplier onboarding by embedding risk due diligence and assessment workflows, allowing organizations to make informed decisions about supplier acceptance and minimize operational risks.

    Show full answer Show less

    Key Features

    • Integrated Risk Assessment Workflow: Supplier managers initiate onboarding using guided playbooks that trigger due diligence requests evaluated by third-party risk (TPR) assessors.
    • Due Diligence and Risk Questionnaires: The process includes inherent risk questionnaires for internal assessors and external due diligence questionnaires completed by suppliers via the Supplier Collaboration Portal.
    • Risk Scoring and Approval: TPR managers review and approve due diligence requests, update risk records with final ratings, and facilitate contract approvals tied to risk outcomes.
    • Automated Tracking and Notifications: Unique IDs track due diligence requests, and email notifications inform stakeholders upon approval and completion of risk assessments.
    • Comprehensive Data Management: Combines supplier data, risk scores, and contract information to support informed onboarding decisions.

    Requirements

    • Installation of Supplier Lifecycle Operations and Third-party Risk Management applications from the ServiceNow Store.
    • Activation of Risk Assessments Integration for Supplier Lifecycle Operations and GRC: Third-party Due Diligence Request plugins.
    • Valid licensing for Third-party Risk Management is required to leverage the integrated solution.

    Practical Use and Workflow

    ServiceNow customers use this integration to:

    • Create and onboard suppliers using predefined playbooks that automate due diligence initiation.
    • Assign and manage risk assessment tasks between supplier managers, TPR managers, and assessors.
    • Collect risk assessment data from both internal stakeholders and external suppliers through structured questionnaires.
    • Review and approve risk ratings before finalizing contracts and completing the onboarding process.
    • Utilize risk assessment outcomes to determine whether to proceed with or halt supplier onboarding, thereby minimizing potential risks.

    With Risk Assessments Integration for Supplier Lifecycle Operations, you can identify and assess potential supplier risks when onboarding new suppliers.

    Combined benefits of integrating Supplier Lifecycle Operations with Third-party Risk Management

    Feature Supplier Lifecycle Operations Third-party Risk Management All applications together

    Supplier onboarding

    		 Yes No Yes
    Information and data management Yes No Yes
    Case and dispute management Yes No Yes
    Risk onboarding No Yes Yes
    Third-party risk due diligence, external and internal risk assessment No Yes Yes
    Risk intelligence No Yes Yes
    Risk scoring and monitoring No Yes Yes
    Risk executive dashboard No Yes Yes

    Workflow of Risk Assessments Integration for Supplier Lifecycle Operations

    Use Supplier Lifecycle Operations and Third-party Risk Management together for these benefits:
    • Evaluate supplier risk when onboarding suppliers
    • Analyze risk score to determine whether to onboard a supplier

    The following figure shows an example workflow of how a supplier manager and a third-party risk (TPR) assessor can use the applications together to evaluate supplier risk.

    Figure 1. The Supplier Lifecycle Operations and Third-party Risk Management workflow
    SLO and TPRM risk assessment flow
    In this workflow:
    1. The supplier manager receives a supplier onboarding request.
    2. The supplier manager uses the onboarding playbook, which provides a streamlined and guided process to onboard suppliers. For more information, see Using the supplier onboarding playbook to onboard suppliers.
    3. The supplier manager submits a due diligence request.

      Performing due diligence is a key aspect of onboarding a supplier. The supplier risk assessment is done by the third-party risk (TPR) assessor. For more information, see Get started with Risk Assessments Integration for Supplier Lifecycle Operations.

    4. The TPR manager approves the due diligence request.
    5. The inherent risk questionnaire is created and assigned to the TPR assessor.
    6. The TPR assessor submits the completed IRQ.
    7. Two risk assessment questionnaires are created and assigned to the supplier contact.
    8. The supplier contact logs in to the Supplier Collaboration Portal and completes the risk assessment questionnaires.
    9. A contract record is created with an approval. After the contract record is approved, the risk record is updated with the final rating.
    10. The supplier manager accepts the risk rating and closes the due diligence request.

    Requirements for integrating Supplier Lifecycle Operations and Third-party Risk Management

    1. Install the Supplier Lifecycle Operations (com.snc.sn_supplier_mgmt) application from the ServiceNow® Store. For more information, see Install Supplier Lifecycle Operations.
    2. Install and activate the Risk Assessments Integration for Supplier Lifecycle Operations (com.snc.sn_supplier_tprm) plugin.
    3. Install the Third-party Risk Management (com.sn_vdr_risk_asmt) application from the ServiceNow® Store. For more information, see Configuring Third-party Risk Management.
    4. Install and activate the GRC: Third-party Due Diligence Request (com.sn_tprm_onboarding) plugin.
    Note:
    You must have a license for Third-party Risk Management (formerly Vendor Risk Management) to take advantage of this better together solution.

    Get started with Risk Assessments Integration for Supplier Lifecycle Operations

    Get started with Risk Assessments Integration for Supplier Lifecycle Operations by completing these tasks:

    1. Create a supplier. For more information, see Create a supplier from the Source-to-Pay Workspace.
    2. Onboard a new supplier using playbooks. For more information, see Using the supplier onboarding playbook to onboard suppliers.
    3. The playbook creates a due diligence request. For more information about the fields in this activity, see Request due diligence for a third-party engagement.
    4. The supplier manager fills and submits a due diligence request, which is assigned to the TPR manager.
      Note:
      For each due diligence request, the system auto-assigns a unique ID number that starts with the prefix DDR.
    5. If the due diligence request is approved by the TPR manager, the inherent risk questionnaire (IRQ) is sent to the TPR assessor (internal stakeholder).
    6. After the TPR assessor submits the completed IRQ, the due diligence process begins.
    7. The due diligence process creates two risk assessments, each containing an external due diligence questionnaire, one for the third-party and another for engagement.
    8. After the supplier contacts complete and submit the external questionnaires from the Supplier Collaboration Portal, the TPR manager goes through the questionnaires and approves the due diligence request. For more information, see Complete a risk assessment from the Supplier Collaboration Portal.
    9. A contract record is created with an approval. After the contract record is approved, the risk record is updated with the final rating.
    10. After the supplier manager accepts the risk rating, an email is sent to the requester informing that the due diligence request has been successfully processed and approved.
    11. The supplier manager closes the due diligence request (case).
    12. As a supplier manager, you can use the risk assessment result data in combination with any other data to determine whether to continue or cancel the onboarding process.