Data Glossary for Third-Party Risk Management Reports

OneTrust Third-Party Risk Management helps organizations streamline vendor evaluation and risk mitigation with out-of-the-box assessment templates and workflow automation. Vendor reports built from the data captured by the Third-Party Risk Management module can be used to view information on vendor details and metadata, a categorical summary of risk levels, and risks and controls associated with each vendor.

Available Third-Party Risk Management Report Templates

The following report templates are available in the Reports Gallery when you select the Third-Party Risk Management data source. You can view the available Reports Gallery templates by clicking the Create New button on the Reports screen. All templates will display by default, but can be narrowed down based on your selected data source or report type.


Report Name	Description	Data Source	Report Type	Data Type
Asset Overview and Risk Summary	Used to view information on assets and the risks associated with those assets.	Data Mapping Automation	PDF	Asset
Basic Asset Review	Used to view details on all assets and the related information on each asset.	Data Mapping Automation	Column	Asset
Basic Vendor Review	Used to view information on every vendor along with the related attribute information.	Data Mapping Automation	Column	Vendor
Vendor Default PDF	Used to view vendor information, including metadata, categorical summary of all risk levels, controls, and a detailed breakdown of risks.	Data Mapping Automation	PDF	Vendor
Vendor Overview and Risk Summary	Used to view information on vendors, such as the risks and controls associated with each vendor.	Data Mapping Automation	PDF	Vendor
Vendor Risks and Controls	Used to view risks and controls associated with all vendors.	Data Mapping Automation	Column	Vendor
Vendor Risk Summary Report	Used to view all vendor details and related information, such as contracts, engagements, and personal data collected by each vendor.	Data Mapping Automation	PDF	Vendor

Available Data on Third-Party Risk Management Reports

The following fields are available to be included on Third-Party Risk Management reports. The fields that display in a report will automatically populate depending on the report template you selected when creating the report.

Note:

Certain inventory may also be linked to show an all encompassing view of the data flow. For more information on inventory relationship types, see About Inventory Linking and Relationships.


Field	Data Format	Classification	Description	Related Objects	Applicable Report Templates
ID	Text	Metadata	The unique identifier for the record of a particular inventory type.	Vendor / Related Inventory	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Inventory ID	Text	Metadata	The inventory ID of the asset, processing activity, entity, or vendor.	Vendor / Related Inventory	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Name	Hyperlink	Metadata	The name of the vendor.	Vendor / Related Inventory	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Is Master	Multi	Metadata	Indicates if an inventory is a parent/master record.	Vendor / Related Inventory	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Last Updated Date	Date	Metadata	The date when the record was last updated.	Vendor / Related Inventory	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Last Updated By	User	Metadata	The name of the user who last updated the record.	Vendor / Related Inventory	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Location	Multi	Metadata	The country where the vendor is headquartered.	Vendor / Related Inventory	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Master Record	Text	Metadata	The master inventory record to which the vendor record belongs (if a local version).	Vendor / Related Inventory	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Aggregate / Inherent / Residual / Target Risk Level	Multi	Metadata	The likelihood that the vendor could expose personal information if controls are not in place, if current controls are implemented, and the target desired level of exposure.	Vendor / Related Inventory	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Aggregate / Inherent / Residual / Target Risk Score	Text	Metadata	The overall risk score associated with the vendor without considering existing controls, with existing controls, and the desired target score.	Vendor / Related Inventory	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Aggregated Contract Cost	Text	Metadata	The sum of costs for all contracts associated to the specific vendor.	Vendor / Related Inventory	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Business Owner	User	Metadata	The internal user sponsoring the vendor.	Vendor / Related Inventory	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Created By	User	Metadata	The name of the user who created the record.	Vendor / Related Inventory	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Created Date	Date	Metadata	The date when the record was created.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Criticality	Multi	Custom	The level of criticality that the vendor is to the business.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Organization	Multi	Metadata	The name of the organization responsible for the vendor record.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Status	Multi	Metadata	The current status of the vendor.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Workflow	Multi	Metadata	The name of the workflow followed by the vendor.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Stage	Multi	Metadata	The current stage of the workflow that the vendor is in.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
System / Custom Attribute - Date	Date	Custom	System or custom attribute created with Date format.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
System / Custom Attribute - Multi-choice	Multi	Custom	System or custom attribute created with Multi-choice format.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
System / Custom Attribute - Text	Text	Custom	System or custom attribute created with Text Type format.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Created Date - Risk	Date	Metadata	The date the risk record was created.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Risk ID - Risk	Text	Default	The risk ID.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Inherent / Residual / Target Risk Impact Level - Risk	Text	Default	The impact a risk would have on an organization if it occurred without controls to mitigate, with current implemented controls, and the target desired impact of a risk.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Inherent / Residual / Target Risk Level - Risk	Text	Default	The risk level if it occurred without controls to mitigate, with current implemented controls, and the target risk level.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Inherent / Residual / Target Risk Probability Level - Risk	Text	Default	The probability of a risk occurring if there are no controls in place, if current controls are implemented, and the target desired probability of the risk occurring.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Inherent / Residual / Target Risk Score - Risk	Text	Default	The risk score without considering existing controls, with existing controls, and the desired risk score.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Risk Level - Risk	Multi	Attribute	The likelihood that the vendor could be breached.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Organization - Risk	Text	Default	The organization responsible for the risk.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Result - Risk	Text	Default	The action taken on the risk. Actions include: accepted, avoided, ignored, reduced, rejected, transferred	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Risk Approver - Risk	Text	Default	The name of the person responsible for approving the risk.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Risk Categories - Risk	Multi	Attribute Array	The associated category that the risk is assigned to. Example categories include: financial, geographic, operational, regulatory/compliance, security	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Risk Description - Risk	Text	Default	A brief description of the risk.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Risk Owners - Risk	Text	Default	The name(s) of the individual(s) responsible for remedying the risk.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Risk Score - Risk	Text	Default	The current risk score.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Risk Source - Risk	Text	Attribute	The source or collection point of the data.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Stage - Risk	Text	Default	The current risk stage.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Threat - Risk	Text	Default	The threat(s) the risk poses to your company.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Treatment - Risk	Text	Default	The process by which the risk owner actively mitigates the risk.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Treatment Plan - Risk	Text	Default	A plan that includes completing specific tasks, assigning a risk owner, and adding controls to mitigate the risk.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Treatment Status - Risk	Text	Default	The current status of the treatment plan. Status levels include: in progress, under review, exception requested, exception granted	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Risk Type - Risk	Text	Default	The type of risk. Options include: asset, entity, processing activity, or vendor.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
{Risk Category}: Inherent / Residual / Target Risk Level - Categorical Risks	List	Custom	The inherent, residual, and target risk level defined by risk category.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
{Risk Category}: Inherent / Residual / Target Risk Score - Categorical Risks	Double	Custom	The overall inherent, residual, and target risk score defined by risk category.	Vendor Risk	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Contract Approved Date - Contracts	Date	Default	The date on which the contract was approved by your organization.	Contracts	All Third-Party Risk Management Column Reports
Contract Approvers - Contracts	Text	Default	The name of the person who approved/signed the contract.	Contracts	All Third-Party Risk Management Column Reports
Contract Name - Contracts	Text	Attribute	The name of the contract.	Contracts	All Third-Party Risk Management Column Reports
Contract Owner - Contracts	User	Attribute	The user who is responsible for the contract.	Contracts	All Third-Party Risk Management Column Reports
Contract URL - Contracts	Hyperlink	Default	The URL for a hosted contract document.	Contracts	All Third-Party Risk Management Column Reports
Contract Cost - Contracts	Number	Default	The value or total cost of a contract.	Contracts	All Third-Party Risk Management Column Reports
Contract Currency - Contracts	Text	Default	The currency used for the contract.	Contracts	All Third-Party Risk Management Column Reports
Contract Agreement Created Date - Contracts	Date	Default	The date that the contract was generated/created.	Contracts	All Third-Party Risk Management Column Reports
Contract Expiration Date - Contracts	Date	Default	The date in which the contract will expire.	Contracts	All Third-Party Risk Management Column Reports
Contract Note - Contracts	Text	Default	All relevant notes about the contract.	Contracts	All Third-Party Risk Management Column Reports
Contract Status - Contracts	Multi	Attribute	The current status of the contract: new, in progress, under review, signed, expired, on hold, terminated	Contracts	All Third-Party Risk Management Column Reports
Contract Type - Contracts	Multi	Attribute	The current status of the contract: new, in progress, under review, signed, expired, on hold, terminated	Contracts	All Third-Party Risk Management Column Reports
Contract Vendor Contact - Contracts	Text	Default	The name or contact details for the other party in the contract.	Contracts	All Third-Party Risk Management Column Reports
Engagement End Date - Engagements	Date	Attribute	The target end date of the engagement.	Engagements	All Third-Party Risk Management Column Reports
Engagement External Contact - Engagements	Text	Attribute	Information about an external contact responsible for the engagement.	Engagements	All Third-Party Risk Management Column Reports
Engagement Internal Owner - Engagements	User	Attribute	The internal user responsible for the engagement.	Engagements	All Third-Party Risk Management Column Reports
Engagement Name - Engagements	Text	Attribute	The name of the engagement.	Engagements	All Third-Party Risk Management Column Reports
Engagement Notes - Engagements	Text	Attribute	Additional information that may assist in the evaluation process.	Engagements	All Third-Party Risk Management Column Reports
Engagement Organization - Engagements	Text	Attribute	The name of the organization implementing the engagement.	Engagements	All Third-Party Risk Management Column Reports
Engagement Scope - Engagements	Text	Attribute	The scope of the engagement.	Engagements	All Third-Party Risk Management Column Reports
Engagement Start Date - Engagements	Date	Attribute	The start date of the engagement.	Engagements	All Third-Party Risk Management Column Reports
Engagement Type - Engagements	Text	Attribute	The type of engagement.	Engagements	All Third-Party Risk Management Column Reports
Engagement Workflow - Engagements	Multi	Attribute	Name of the workflow followed by the engagement.	Engagements	All Third-Party Risk Management Column Reports
Engagement - Workflow Stage - Engagements	Text	Attribute	Current stage of the workflow that the engagement is in.	Engagements	All Third-Party Risk Management Column Reports
Control ID - Controls	Hyperlink	Default	The unique identifier to support integration across applications.	Controls	Vendor Risks and Controls
Control Name - Controls	Text	Attribute	The name of the control.	Controls	Vendor Risks and Controls
Standard / Framework - Controls	Multi	Attribute	The frameworks in which you can add controls.	Controls	Vendor Risks and Controls
Status - Controls	Multi	Attribute	The current status of the control. Status options include: pending, implemented, not doing	Controls	Vendor Risks and Controls
Effectiveness - Controls	Multi	Attribute	The effectiveness of an implemented control. Options include: effective, ineffective, planned	Controls	Vendor Risks and Controls
Maturity - Controls	Multi	Attribute	The maturity of an implemented control.	Controls	Vendor Risks and Controls
Description - Controls	Text	Default	A brief description of the control.	Controls	Vendor Risks and Controls
Control Owner - Controls	User	Attribute Array	The user who is responsible for the control.	Controls	Vendor Risks and Controls
Category - Controls	Multi	Attribute	The associated category that the control is assigned to.	Controls	Vendor Risks and Controls
Deadline - Controls	Date	Default	The date by when the control must be implemented.	Controls	Vendor Risks and Controls
Classification - Personal Data	Multi	Attribute Array	The data classification into which the data element fits.	Personal Data	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Data Classification Description - Personal Data	Text	Attribute	A brief description of the data classification.	Personal Data	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Data Category - Personal Data	Multi	Attribute	The data category into which the data element fits.	Personal Data	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Data Category Description - Personal Data	Text	Attribute	A brief description of the data category.	Personal Data	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Data Element - Personal Data	Multi	Attribute	The name of the data element.	Personal Data	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Data Element Description - Personal Data	Text	Attribute	A brief description of the data element.	Personal Data	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Data Subject - Personal Data	Multi	Attribute	The name of the data subject. Examples include: customers, employees, and applicants	Personal Data	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Data Subject Type Description - Personal Data	Text	Attribute	The data subject type to which the data element is assigned.	Personal Data	All Third-Party Risk Management Column Reports All Third-Party Risk Management PDF Reports
Approver - Assessment Summary	User	Metadata	The approver of the assessment.	Related Assessment	All Third-Party Risk Management Column Reports
Creator - Assessment Summary	User	Metadata	The creator of the assessment.	Related Assessment	All Third-Party Risk Management Column Reports
Date Completed - Assessment Summary	Date/Time	Metadata	The date the assessment was completed.	Related Assessment	All Third-Party Risk Management Column Reports
Date Created - Assessment Summary	Date/Time	Metadata	The date the assessment was created.	Related Assessment	All Third-Party Risk Management Column Reports
Date Submitted - Assessment Summary	Date/Time	Metadata	The date the assessment was submitted.	Related Assessment	All Third-Party Risk Management Column Reports
Deadline - Assessment Summary	Date/Time	Metadata	A due date for the assessment.	Related Assessment	All Third-Party Risk Management Column Reports
Description - Assessment Summary	Text	Metadata	A brief description of the assessment.	Related Assessment	All Third-Party Risk Management Column Reports
GUID - Assessment Summary	Text	Metadata	The unique number of the assessment ID field.	Related Assessment	All Third-Party Risk Management Column Reports
High Risks - Assessment Summary	Number	Metadata	The total number of risks captured on an assessment with a high risk level.	Related Assessment	All Third-Party Risk Management Column Reports
ID - Assessment Summary	Number	Metadata	The assessment ID number.	Related Assessment	All Third-Party Risk Management Column Reports
Inherent / Residual / Target Risk Level - Assessment Summary	Multi	Metadata	The risk level captured on an assessment.	Related Assessment	All Third-Party Risk Management Column Reports
Inherent / Residual / Target Risk Score - Assessment Summary	Number	Metadata	The risk score captured on an assessment.	Related Assessment	All Third-Party Risk Management Column Reports
Low Risks - Assessment Summary	Number	Metadata	The total number of risks captured on an assessment with a low risk level.	Related Assessment	All Third-Party Risk Management Column Reports
Medium Risks - Assessment Summary	Number	Metadata	The total number of risks captured on an assessment with a medium risk level.	Related Assessment	All Third-Party Risk Management Column Reports
Name - Assessment Summary	Hyperlink	Metadata	The name for the assessment.	Related Assessment	All Third-Party Risk Management Column Reports
Open Info Request - Assessment Summary	Number	Metadata	A need for more information request that hasn't been addressed.	Related Assessment	All Third-Party Risk Management Column Reports
Open Risk Count - Assessment Summary	Number	Metadata	A need for more information request that hasn't been addressed.	Related Assessment	All Third-Party Risk Management Column Reports
Organization - Assessment Summary	Multi	Metadata	The organizational group which is responsible for the assessment.	Related Assessment	All Third-Party Risk Management Column Reports
Pending Reviews - Assessment Summary	User	Metadata	The assessments that are waiting to be reviewed.	Related Assessment	All Third-Party Risk Management Column Reports
Primary Record Id - Assessment Summary	Number	Metadata	The number ID of the primary record.	Related Assessment	All Third-Party Risk Management Column Reports
Primary Record Name - Assessment Summary	Text	Metadata	The name of the primary record.	Related Assessment	All Third-Party Risk Management Column Reports
Respondent - Assessment Summary	User	Metadata	The respondent of the assessment.	Related Assessment	All Third-Party Risk Management Column Reports
Result - Assessment Summary	Multi	Metadata	Whether or not the assessment is approved or rejected.	Related Assessment	All Third-Party Risk Management Column Reports
Result Comments - Assessment Summary	Text	Metadata	The comments that accompany the result of the assessment.	Related Assessment	All Third-Party Risk Management Column Reports
Risk Level - Assessment Summary	Multi	Metadata	The risk level captured on an assessment.	Related Assessment	All Third-Party Risk Management Column Reports
Risk Score - Assessment Summary	Number	Metadata	The risk score captured on an assessment.	Related Assessment	All Third-Party Risk Management Column Reports
Template - Assessment Summary	Text	Metadata	A questionnaire used to send assessments.	Related Assessment	All Third-Party Risk Management Column Reports
Template Version - Assessment Summary	Number	Metadata	The editable version of a published template.	Related Assessment	All Third-Party Risk Management Column Reports

Platform Capabilities

Data Glossary for Third-Party Risk Management Reports

Available Third-Party Risk Management Report Templates

Available Data on Third-Party Risk Management Reports

In this Topic