Third-Party Due Diligence Automation Rules Use Cases

You can create and configure inventory rules to automatically launch assessments, send emails, and send reports. To create an automation rule, see Adding, Editing, and Deleting Third-Party Automation Rules.

This article provides several automation rule use cases that can be used to help configure automation rules for a specific purpose.

Annual Reassessments

The purpose of this configuration is to send annual reassessments to third-parties that meet a specific risk threshold. A similar rule can be created to send a reassessment every 2-3 years for lower risk third-parties.



Rule Explanation

  • This condition and action combination can be configured to see if a third-party with high or very high aggregate risk scores has completed a particular assessment within the past year. If this is true, it will send a reassessment of the same template to the previous assessment's respondents with all the latest values of the third-party updated.

  • If the third-party has never completed this assessment and meets a specific risk threshold, it will still evaluate this condition to be TRUE so that it can be combined with the Send New Blank Assessment if no Assessment Found scenarios.

  • The purpose of the Send New Blank Assessment if no Assessments Found is to guarantee a third-party has completed an assessment of a particular template if it is a mandatory part of the third-party workflow. In the screenshot above, the Send New Blank Assessment if No Assessment is Found is left unchecked, this means the automation rule WILL NOT send a blank assessment to third-parties that do not already have an in progress or completed assessment template named in the automation rule Action.

Additional Information for Send New Blank Assessment if No Assessment is Found

Tip:

The following tips provide more insight on how Send New Blank Assessment if No Assessment is Found works using an annual third-party reassessment as an example.



  • In the example above, If a third-party has never completed an assessment for the Template named in the Condition then the rule Action will be executed.

    Additionally, if Send New Blank Assessment if No Assessment is Found is NOT selected in the Action AND the third-party does not have a completed assessment from the Templatenamed in the rule Action , then the third-party WILL NOT receive an assessment for the Template named in the Action.  

    On the other hand, if Send New Blank Assessment if No Assessment is Found is not selected and the third-party DOES have a completed assessment, then the third-party will receive an assessment from the template named in the rule action.

  • If the Send New Blank Assessment if No Assessment is Found is selected, the automation rule WILL send a blank assessment from the template named in the rule action to third-parties that do not already have an in progress or completed assessment for the Template named in the automation rule Action.

  • If Copy Previous Assessment is not enabled, the automation rule WILL send a blank assessment for the Template named in the rule Action to third-parties that do not already have the assessment in progress or completed, functioning as if the Send New Blank Assessment if No Assessment is Found is selected.

Monthly Report

The purpose of this configuration is to send a monthly PDF report on all third-parties that meet a specific condition. In the example below, a report is sent if a third-party has a Payment Card Industry Data Security Standard (PCI DSS) expiration approaching within the next 30 days.



Rule Explanation

  • This condition and action combination can be configured to send a report to an internal user when the PCI DSS expiration date is within 30 days. The frequency should be set to the first of the month, monthly.

Tip:

We recommend using 45 as the number value in the conditions block to capture expiration dates that fall on the first week of the upcoming month. For example, if a third-parties PCI DSS expiration is March 2 and the rule is configured to check 30 days ahead of time, the user would not receive a report until March 1. This would only give the user one day to take action.