CIS-TPRM: Certified Implementation Specialist - Third-Party Risk Management

In ServiceNow Assessments, each non-scripted assessment metric defines a questionnaire question. Assessment Metric records are stored in the asmt_metric table.

ServiceNow stores external third-party risk assessments in the sn_vdr_risk_asmt_assessment table. The task and issue tables store follow-up work and identified issues rather than the assessment records themselves.

ServiceNow Third-party Risk Management sends the default pending-assessment reminders to the third-party contact at 30 days before the due date and again at 7 days before the due date.

ServiceNow Third-party Risk Management supports due-diligence requests to onboard a new engagement, reassess an existing engagement, reassess an engagement for contract renewal, and offboard an engagement with due diligence. It also supports offboarding without due diligence, which is not among the choices. Duplicating or canceling an engagement is not a due-diligence request type.

A third-party assessment rating is derived from the scores and ratings of questionnaires and document requests, weighted by risk area. Incorrect questionnaire responses and omitted requested documentation can therefore affect the rating. Reassigning a questionnaire can change the contact authorized to complete it and consequently the responses that determine its score.