Third-Party Due Diligence Terminology Guide

Activity History

A detailed record of attribute changes made during the due diligence process.

Assessment / Assessment form 

A completed question template which contains actual responses and data relating to a third party.

Assessment Template

A set of structured questions to collect risk information about a third party. 

The template can contain logic to surface or hide questions.  It can also automatically generate risk records in OneTrust based on defined responses. Assessment templates are often referred to as a questionnaire.

Attribute

You can add, edit, and deactivate attributes. Attributes are data points (fields or containers), that capture details about a third party. 

All System Attributes are default attributes. Custom attributes can be created in the Attribute Manager. 

Automation Rules

A set of rules that can be triggered, daily, weekly or monthly. 

When triggered, rules that meet the defined conditions can execute a series of actions, like Send Assessment to Third Party, or Send an Email.

Due Diligence Questionnaire (DDQ)

A structured set of questions designed to gather detailed information about a third party’s operations, compliance practices, and risk factors.

Integration Workflow

Integration workflows help automate specific tasks or data retrieval from third-party systems, while also helping to create or update data inside the OneTrust application. 

Integration workflows can also update third-party marketing systems, create tickets, an more. 

Inventory

A collection of various types of records, such as Assets, or Legal Entity Vendors. For Third-Party Due Diligence, a Vendor inventory is the primary inventory type.

Key Risk Indicators (KRIs)

Specific metrics used to monitor and measure potential risks associated with third-party relationships. These indicators help organizations identify and mitigate risks before they escalate.

Linked Entity

Child relationships to third-party records which can be screened and monitored. The standard relationships are:

•  Affiliated Organizations

• Beneficial Owners

• Board Member

Custom values can also be added.

Regulatory Requirements

The laws, regulations, and standards that organizations must comply with when managing their third-party relationships. These requirements are designed to ensure ethical practices, prevent corruption, and protect data, among other objectives.

Risk Analytics

The process of analyzing data to identify, assess, and mitigate risks associated with third-party relationships.

Risk Appetite

The level of risk an organization is willing to accept in its third-party engagements.

Risk Assessment

The systematic process of identifying and evaluating risks posed by third parties.

Risk Assessment Workflow

The sequence of steps and processes used to conduct risk assessments, including data collection, analysis, and reporting.

Risk-Based Approach

A strategy that prioritizes resources and efforts based on the level of risk posed by third parties.

Risk Exposure

The potential impact of risks associated with third-party relationships on the organization.

Risk Management Framework

A structured approach to managing risks, including policies, procedures, and tools.

Risk Mitigation

Actions taken to reduce or avoid the likelihood or impact of risks.

Risk Scoring

The process of assigning numerical values to risks based on their likelihood and impact. There are two ways to complete risk scoring: basic or matrix risk scoring.

Risk Treatment Plan

A detailed plan outlining how identified risks will be managed and mitigated.

Stage Rules

Rules that are evaluated as soon as a third party reaches a specific stage.

Third Party

A generic term for a party in the supply chain that sells goods or services to businesses or consumers. In the realm of Third Party Due Diligence, a third party is used frequently to refer to a vendor. The terms are interchangeable.

Third-Party Due Diligence (TPDD)

The process of assessing and managing risks associated with third-party relationships.

Third-Party Risk Exchange

A platform for sharing and accessing risk information about third parties.

Vendor

A generic term for a party in the supply chain that sells goods or services to businesses or consumers.  In the realm of Third Party Due Diligence, a vendor is frequently referred to as a third party. The terms are interchangeable.

Vendor Lifecycle Management

The process of managing vendor relationships from onboarding to offboarding.

Vendor Risk Assessment Questionnaire (VRAQ)

A set of questions used to assess the risk profile of a vendor.

Vendor Risk Assessment Template

A standardized template used to conduct vendor risk assessments.

Vendor Risk Management Policy

A policy outlining the organization’s approach to managing vendor risks.

Vendor Risk Mitigation Plan

A plan outlining actions to reduce vendor-related risks.

Vendor Risk Monitoring

The ongoing process of tracking and assessing vendor risks.

Vendor Risk Profile

A detailed profile of a vendor’s risk factors and overall risk level.

Vendor Risk Rating

A numerical or categorical rating assigned to a vendor based on their risk profile.

Third Party Workflow

A set of pre-defined business process steps that ensures consistent handling of third parties. 

Workflows can be customized to meet your unique business needs.  

Workflow Rules

Workflow rules are based on an event trigger. Anytime the event occurs for the third party, the rules within that event group are evaluated.