FAQs for Third-Party Management

Vendor workflows and workflow stages offer ways to quickly view and update where a vendor stands in your organization.

For example, you may be in the process of onboarding, offboarding, or rejecting a vendor.

The default workflow is the workflow set to your vendor when the vendor is added for the first time. The vendor will begin in the first stage of the workflow. You can manage which workflow you want as your default at any time via the Third-Party Risk Management Workflows screen.

For more information, see Adding and Editing Vendor Workflows.

OneTrust has provided three default system workflows for your use. These workflows can be cloned and deactivated if you do not want to use them.

For more information on cloning or deactivating workflows, see Adding and Editing Vendor Workflows.

To configure vendor workflows and stages, navigate to the Workflows tab of the Third-Party Risk Management module and select Vendor Workflows. You have the ability to add new workflows or clone, publish, and archive existing workflows.

You can configure different stages to be included within each workflow and remove created stages at any time. The items that can be configured include:

• Stage Badge Colors

• Stage Names

• Stage Descriptions

For more information, see Adding and Editing Vendor Workflows.

Standard offboarding in OneTrust leverages OOTB workflows and checklists to simplify and standardize vendor offboarding and deprovisioning.

Third parties are moved to an offboarding specific workflow which guides internal users and the vendor through pre-determined steps to ensure complete termination of business, technical, and data connection. Workflows feature standardized tasks, assessments, approvals, and escalations to defined owners and collaborators.

Offboarding is initiated through configurable triggers such as contract or engagement expiration, incident severity, performance breaches, or risk posture changes, including events sourced from upstream S2P or ERP systems. Any of these events can launch offboarding workflows automatically through automation and workflows rule configuration.

Yes. Out‑of‑the‑box offboarding checklists cover standard data and contractual obligations and makes it easy for a vendor to attest and attach evidence of adherence. Customer checklists can be easily configured to match your organization’s needs.

The vendor portal collects attestations and artifacts confirming data return or deletion, with all evidence stored on the third‑party record for easy auditability.

Preconfigured integrations notify downstream business systems to disable access, halt purchasing, and confirm deprovisioning across associated products and services.

The vendor or engagement workflow rule configured will be triggered if:

• Updates are made on a vendor or engagement record.

• Bulk updates are made to vendor or engagement records on the list screens.

• Updates are made on the parent of a vendor via global/local records when attribute syncing is enabled.

• The vendor or engagement risk level or risk score change due to risk updates.

• The vendor or engagement organization is deleted.

• The vendor or engagement status is changed.

The vendor or engagement workflow rule configured will not be triggered if:

• You manually change the vendor or engagement stage.

• You manually change the vendor or engagement workflow.

• Updates are made using the Update Third Parties import template.

• Updates are made using the Update Vendors import template.

• Updates are made using the Update Engagements import template.

• Updates are made to a vendor or engagement via an assessment.

For more information, Adding Workflow Rules to Vendor Workflows.

Workflow rules are evaluated in sequential order. The first rule that meets all the conditions will advance the workflow to the stage specified in that rule.

When a vendor reaches the stage, the action will automatically be taken and will not validate against conditions.

The stage rules are evaluated asynchronously.

The next stage rule will be evaluated.

No. There's a validation check that will prevent sending duplicate assessments when the vendor still has an open assessment using the same template.

No. When using the workflow stage rule to launch an assessment, the assessment will not launch if an existing one is open using the same template.

The assessment would not be sent since there is no valid respondent assigned to the assessment.

The user would be replaced with their manager and if no manager assigned, the user would be replaced with the default approver of the organization.

If you have used the same assessment template, the report is sent using the last completed assessment only.

When an engagement is created manually in the platform, the Engagement Created trigger will advance the workflow stage as expected. When an engagement is created via the API, the rule does not trigger and the workflow remains in the current stage.

A user with the Project Respondent role can do the following:

• Create a password and log into your account

• Access a list of all assessments assigned to them

• Be assigned assessments and respond to assigned assessments

• Be assigned risks, needs more information, and add comments to assessments

Project Respondents can manage and view the list of assessments assigned to them within the account. Since users with the Project Respondent role can login with a password, it will be easier to track who is making updates and responding to assessments.

Any unrecognized user emails added to the respondent field prior to launching an assessment will be grouped into a list. You can review this list and create accounts for these users to login with the Project Respondent role.

The Project Respondent flow is controlled via the Global Settings under Assessments. Ensure you have the Allow Creating Project Respondents from Assessments option enabled. If the Allow Creating Invited User setting is disabled and a template with an inventory or user attribute question is published, new users will be created as Project Respondents.

Yes. For more information on reassigning an Invited User role, see Converting an Invited User to a Project Respondent.

No. Access to the Self-Service Portal is not included in the permissions for a Project Respondent. To give access to the Self-Service Portal, you can create a custom role by copying the Project Respondent role and adding permissions. See Custom Role Troubleshooting to confirm needed permissions.

The metadata visible to project respondents depends on their permissions.

With a standard Project Respondent role, the user will have basic access. If you want to give the user expanded access to your assessments metadata, you can create a custom copy of the Project Respondent role and add the Advanced Assessment Metadata permission to the role.

For more information, see Creating and Editing Custom Roles.

Metadata Visibility for Project Respondents

Metadata	Basic access	Advanced access
Assessment Metadata Pane
Basic Information
Name
Organization
Template
Workflows
Description
Deadline
Reminder
Send Email to
Primary record
Tags
Workflow approvers
Approver(s)
Comments
Participants
Respondent(s)
Comments
Additional information
ID
Stage
Stage details (workflow status bar)
Result
Result Comments
Date Created
Creator
Template Version
Question Labels
Residual Risk Score
Open Risk Count
Open Info Request Count
Inherent Risk Score
Target Risk Score
Assessment List Page
ID
Name
Stage
Result
Residual risk score
Organization
Respondent
Approver
Deadline
Open info request count
Open risk count
Tags
Open issue count
Workflows
Template
Creator
Date created
Date completed
Date submitted
Primary record name
Primary record id
Pending reviews
Template version
Approval stage
Inherent risk score
Target risk score

The welcome section tiles are actionable tiles that can be configured to your assessment templates. The tiles provide guidance to your respondents on the many ways they can complete an assessment. The methods for completing an assessment include:

• Answer Online - This option takes the user to the first question.

• Export and Import from Excel - This option allows users to export an Excel version of the assessment and import the assessment back into OneTrust.

• Auto-Complete using a Standard Assessment - This option allows users to upload their SIG to complete the assessment.

When editing the text on your welcome section, there is a setting named Enable "Getting Started" Banner. Enable this setting to see the editable field and update the header and preview of the tiles on your template.

The auto-complete using a standard assessment tile can only be used for assessments that have a Standard Tag applied to it.

At this time, this tile only works with templates that are tagged with the SIG Standard Tag. This tag indicates that the import standard function is supported on the template.

Yes. You can add multiple labels to a question.

Yes/No, multichoice, text, and date question types are supported in the Question Library.

No. Template translations are not currently supported.

Yes. You can create template rules to launch assessments and create risks based on questions from the library.

To configure a controls type question, an inventory or relationship question of single-select type must be added to the template. This process is identical to how attribute questions work. Once an inventory or relationship question is added, the controls question type will be available to add to the template. A single inventory or relationship question can have as many controls type questions tied to it as you want.

If the inventory or relationship question that the control question is associated with is deleted, the control question will be deleted as well.

All controls from your Controls Library will be shown on the question during the response. If the inventory record that the control question is associated with has controls on it already, those controls will pre-populate the question when the assessment is launched. For example, if my vendor had Control A and B on it, when I response to the question, Control A and B will already be selected.

On the template level, response filters can be applied to the controls question. If there are multiple control questions on the template, each control question can have unique response filters.

The items below can be used as filter criteria for controls type question responses:

• Standard/Framework

• Control Category

Any controls that are added to the question response will be added to the linked inventory record upon assessment approval. The controls will have their status updated to “Implemented” by default.

Additionally, any pre-populated controls that were de-selected will be removed from the linked inventory record.

Yes. Any newly added engagements or contracts will be created upon assessment submission and the attributes for the new contract will update accordingly once the assessment is approved.

Yes. Any attributes that contain existing data will be pre-populated and the respondent will have the ability to update them.

Yes. When assessing an existing engagement or contract, all existing values will pre-populate on the assessment when the assessment is launched.

The list will update and show user type attributes for any inventory types that are set as the primary questions on your template.

The assessment will default to the current assessment approver and then the current assessment respondent if there is no approver.

No, you can pull in any user type attribute, including attributes that do not show up as questions.

All user type attributes are shown by their inventory type followed by their attribute name.

No, it is not currently possible.

All the users that review the assessment question with the option enabled will not be able to load a list of answer options.

The respondent must provide a new email response. See the example below:

The user will still appear as a black highlighted option to the respondent and appear as a new user. However, when the assessment is approved, all connections and references will be made and linked to the existing user.

Example:

• John Smith is a registered user on the application with the email jsmith@onetrust.com.

• Upon responding to the assessment question for a vendor's primary contact, jsmith@onetrust.com is typed into the field.

• The question response will still appear as Other Selection.

• Upon approving the assessment, the vendor's primary contact will be accurately updated to John Smith.

Yes, inventory rules are another name for automation rules.

Users have the ability to configure user type attributes of an inventory as respondents on their template rules.

For a given inventory, using Business Owner as an attribute example, any user that is assigned to that attribute will be sent a follow-up assessment if the template rule conditions are true. The scenarios below will result in the assessment being sent to the current assessment approver, and then the respondent if there is no approver:

• The user is inactive

• The user is expired

• The attribute is blank

• The attribute is deactivated

You can edit custom email templates, specifically the Vendor Rules Custom Email template, by selecting Vendor Rules Custom Email in Email Templates dropdown menu, then following these instructions to customize an email template.

You can upload the following file types: .bmp, .csv, .doc, .docx, .heif, .html, .jpeg, .jpg, .md, .pdf, .png, .ppt, .pptx, .tiff, .txt, .xls, .xlsx.

You can upload a maximum of 50 files to an assessment. This limit is cumulative across the assessment, not per upload. If you upload files, generate responses, and later upload more files, they all count toward the same 50-file limit.

You can upload up to 64MB per file.

AI Document Scanner can generate responses for the following question types:

• Yes/no

• Text box

• Single-select and multi-select (MCQ)

• Inventory attribute

• Personal data attribute

No training models are used for this feature. Any data or file uploaded to your assessment remains in the tenant, and is not used for training.

No. AI Document Scanner generates responses only for questions that are still unanswered. It skips any question that has already been answered by any means, whether entered manually, answered by a previous scan, or answered by an earlier auto-response, and does not overwrite existing answers.

Because of this, subsequent uploads only affect unanswered questions. For example, if you upload 10 files and the scanner answers a set of questions, any later upload is used only to answer the questions that remain unanswered. (As a reminder, the 50-file limit is cumulative across the assessment, so later uploads draw from the same total.)

Yes. AI-generated responses are included in any reports you export.

Relevant justification is pulled from all uploaded documents based on how closely each relates to the question in the assessment. The AI response is provided as a single justification for the question.

Gaps and deviations will be provided in justification if explicitly mentioned in the document.

For example, if the document contains the phrase: "We have no data centers located in the EMEA region" and the question in the assessment is: "Are data security protocols followed for data centers in EMEA?", then the response would be: "Not Applicable".

However, if the phrase mentioned above was not in the document, the response would not infer the absence to answer the question as "Not Applicable". It would leave the question unanswered.

Yes. The Source Document section shows multiple documents, and pages within those documents that were used for inference.

The response rate may differ after each use. The variation for each questionnaire depends on the AI model type. A small percentage of variance can occur based on the deployed model type, and this variance is expected.

If you are attempting to answer a SIG questionnaire, OneTrust provides an existing capability to import your SIG file and populate the questionnaires. For more information, see Utilizing the SIG Template Import Responses Feature.

Yes. AI Document Scanner supports this.

No. Any file that is password-protected will not be able to use this feature. However, a PDF with other restrictions (for example, copy protection) can still be used. For instance, if you open the OneTrust SOC 2 file and try to copy text from a page on your laptop, the copy action may be blocked, but the file can still be used by the AI to generate answers to a questionnaire.

Adding a vendor to the Third-Party Risk Exchange means that you will add the Exchange record for a vendor to your inventory. This will create a vendor record that has the same attribute values as the Exchange record.

When you add an Exchange record, the connection to the Third-Party Risk Exchange is established by default. However, a user can choose to disconnect the vendor from the Exchange. This would mean the vendor record and the attributes populated would remain, but the information would no longer be synced from the Exchange, because the connection is no longer there.

Connecting a vendor to the Exchange means that you will connect an existing vendor record in your inventory to the Exchange record in the Third-Party Risk Exchange. The attribute values in your inventory for this vendor will get replaced by the attribute values existing on the Exchange record. These values will be updated with information from the Exchange. For more information, see Connecting a Vendor to the Third-Party Risk Exchange.

This means the record was added from the Exchange and the information is being synced with information from the Exchange.

This means the Exchange record exists in your inventory and was connected at the time of addition, but it was later disconnected and therefore information is no longer being synced from the Exchange.

This means an existing vendor record in your inventory was connected to the Exchange record in the Third-Party Risk Exchange so the information on your record was replaced and is being synced with information in the Exchange.

This means the Exchange record does not exist in your inventory and is not connected to any of your existing vendors.

The option to add an Exchange record to your inventory is only available when that Exchange record does not exist in your inventory – whether that vendor record is connected to the Third-Party Risk Exchange or not.

When you choose to connect a vendor from the Exchange, the vendors that show up in the selection menu are vendors in Active or Pending statuses that do not have an existing connection to the Exchange.

Yes, a record in the Exchange can be connected to multiple vendor records in your inventory.

If you are setting up the Third-Party Risk Exchange for the first time, the related Exchange attributes and attribute groups are not immediately available in your tenant.

These attributes only become available after you link your first vendor to the exchange. Once that step is completed, the system creates the related attribute groups automatically, and the attributes then appear in the vendor Attribute manager and within inventory records. For more information, see Connecting a Vendor to the Third-Party Risk Exchange.

If you archive a vendor connected to the Exchange, the vendor will still appear as Connected, but the sync will be paused until the vendor status is changed to Active or Pending.

You can track in requests in the Status Tracker in the Third-Party Risk Exchange.