FAQs for Managing Third Parties

Vendor workflows and workflow stages offer ways to quickly view and update where a vendor stands in your organization.

For example, you may be in the process of onboarding, offboarding, or rejecting a vendor.

The default workflow is the workflow set to your vendor when the vendor is added for the first time. The vendor will begin in the first stage of the workflow. You can manage which workflow you want as your default at any time via the Third-Party Risk Management Workflows screen.

For more information, see Adding and Editing Vendor Workflows.

OneTrust has provided three default system workflows for your use. These workflows can be cloned and deactivated if you do not want to use them.

For more information on cloning or deactivating workflows, see Adding and Editing Vendor Workflows.

No. There's a validation check that will prevent sending duplicate assessments when the vendor still has an open assessment using the same template.

Yes. Any newly added engagements or contracts will be created upon assessment submission and the attributes for the new contract will update accordingly once the assessment is approved.

Yes. When assessing an existing engagement or contract, all existing values will pre-populate on the assessment when the assessment is launched.

A user with the Project Respondent role can do the following:

• Create a password and log into your account

• Access a list of all assessments assigned to them

• Be assigned assessments and respond to assigned assessments

• Be assigned risks, needs more information, and add comments to assessments

Project Respondents can manage and view the list of assessments assigned to them within the account. Since users with the Project Respondent role can login with a password, it will be easier to track who is making updates and responding to assessments.

Any unrecognized user emails added to the respondent field prior to launching an assessment will be grouped into a list. You can review this list and create accounts for these users to login with the Project Respondent role.

The welcome section tiles are actionable tiles that can be configured to your assessment templates. The tiles provide guidance to your respondents on the many ways they can complete an assessment. The methods for completing an assessment include:

• Answer Online - This option takes the user to the first question.

• Export and Import from Excel - This option allows users to export an Excel version of the assessment and import the assessment back into OneTrust.

• Auto-Complete using a Standard Assessment - This option allows users to upload their SIG to complete the assessment.

You can upload the following file types: .bmp, .csv, .doc, .docx, .heif, .html, .jpeg, .jpg, .md, .pdf, .png, .ppt, .pptx, .tiff, .txt, .xls, .xlsx.

You can upload a maximum of 50 files to an assessment. This limit is cumulative across the assessment, not per upload. If you upload files, generate responses, and later upload more files, they all count toward the same 50-file limit.

AI Document Scanner can generate responses for the following question types:

• Yes/no

• Text box

• Single-select and multi-select (MCQ)

• Inventory attribute

• Personal data attribute

No training models are used for this feature. Any data or file uploaded to your assessment remains in the tenant, and is not used for training.

No. AI Document Scanner generates responses only for questions that are still unanswered. It skips any question that has already been answered by any means, whether entered manually, answered by a previous scan, or answered by an earlier auto-response, and does not overwrite existing answers.

Because of this, subsequent uploads only affect unanswered questions. For example, if you upload 10 files and the scanner answers a set of questions, any later upload is used only to answer the questions that remain unanswered. (As a reminder, the 50-file limit is cumulative across the assessment, so later uploads draw from the same total.)

Any controls that are added to the question response will be added to the linked inventory record upon assessment approval. The controls will have their status updated to “Implemented” by default.

Additionally, any pre-populated controls that were de-selected will be removed from the linked inventory record.

Adding a vendor to the Third-Party Risk Exchange means that you will add the Exchange record for a vendor to your inventory. This will create a vendor record that has the same attribute values as the Exchange record.

When you add an Exchange record, the connection to the Third-Party Risk Exchange is established by default. However, a user can choose to disconnect the vendor from the Exchange. This would mean the vendor record and the attributes populated would remain, but the information would no longer be synced from the Exchange, because the connection is no longer there.

Connecting a vendor to the Exchange means that you will connect an existing vendor record in your inventory to the Exchange record in the Third-Party Risk Exchange. The attribute values in your inventory for this vendor will get replaced by the attribute values existing on the Exchange record. These values will be updated with information from the Exchange. For more information, see Connecting a Vendor to the Third-Party Risk Exchange.

When you choose to connect a vendor from the Exchange, the vendors that show up in the selection menu are vendors in Active or Pending statuses that do not have an existing connection to the Exchange.

If you are setting up the Third-Party Risk Exchange for the first time, the related Exchange attributes and attribute groups are not immediately available in your tenant.

These attributes only become available after you link your first vendor to the exchange. Once that step is completed, the system creates the related attribute groups automatically, and the attributes then appear in the vendor Attribute manager and within inventory records. For more information, see Connecting a Vendor to the Third-Party Risk Exchange.

If you archive a vendor connected to the Exchange, the vendor will still appear as Connected, but the sync will be paused until the vendor status is changed to Active or Pending.

Yes. You can create template rules to launch assessments and create risks based on questions from the library.

Users have the ability to configure user type attributes of an inventory as respondents on their template rules.

For a given inventory, using Business Owner as an attribute example, any user that is assigned to that attribute will be sent a follow-up assessment if the template rule conditions are true. The scenarios below will result in the assessment being sent to the current assessment approver, and then the respondent if there is no approver:

• The user is inactive

• The user is expired

• The attribute is blank

• The attribute is deactivated