Step-by-Step Onboarding Guide: Third-Party Risk Management

1

OneTrust pre-populates the attribute inventory with attributes commonly associated with vendors.

Vendor attributes offer a way to capture and report on information at a greater level of granularity for better insight and visibility into how specific data elements are processed.

You can add, edit, and deactivate attributes as needed to configure the detail fields of your vendor records.

This is the logical first step of your Third-Party Risk Management implementation as when it comes to importing new or existing vendor information, you have all the information fields you want to collect, already in the tool and ready to be populated.

Use the below articles for further guidance:

Vendor System Attributes Guide

Default Attributes

Adding, Editing, and Deactivating Attributes

Adding Custom Attributes

Configuring Attribute Groupings

2

There are four ways you can add a vendor in your vendor inventory.

• Vendorpedia Exchange – With over 75000 vendors listed in the Vendorpedia Exchange, you can search for the vendors you are working with and add them through the UI

Various population methods:

• Bulk import – All the vendors in a spreadsheet can be bulk imported into the tool

• Add using the UI – Manually add the vendor into the vendor inventory by completing all the mandatory fields

• Add through the assessments – Send assessments to the various business owners to identify the vendors that are being used by different departments

Once you save the vendor record and it is added to your vendor inventory, you can modify the vendor information, launch assessments, add risks, and perform several other actions on the Inventory Details screen.

When utilizing the Exchange to add/connect Vendor records to the inventory list, navigate to “Exchange” where you will then see the list of 70000+ supplier profiles. Using the pages or the search functionality, you can then attempt to find the record of the supplier that you wish to add to your inventory or connect to a record that already exists in your inventory. Within the record you will see the option to either connect or add and choose accordingly.

Use the below articles for more guidance on this:

Adding a Vendor to the Inventory from Vendorpedia

Bulk Import

Adding a Vendor to the Inventory

Using the Vendor Inventory

To populate Vendors via assessments, you will first need to create templates. We will go through this in the next step.

3

There are two ways in which you can create a questionnaire template in the tool:

• View our gallery of vendor-related questionnaire templates which has generic templates such as OneVendor, Vendor onboarding, and vendor offboarding. You also have templates for specific standard frameworks such as SIG, CSA, ISO, etc. If there are any of the out-of-the-box templates that meet your company objectives, then you can choose this and edit the same.

• Ability to create a questionnaire from scratch that you have been using in your company.

Once all the questions have been configured you can also:

• Create skip logic which will ensure that the respondent does not have to go through the all the questions, but only specific questions based on the options they select.

• Questions, attachments, justification can be marked as mandatory for the respondents to fill

• Adding rule to the questionnaire based on the answers provided by the respondent

  • Create automated risk and controls workflows

  • Add additional approvers to the assessment

  • Send follow-up assessments on submission or approval of the initial assessment

Use the following articles to help you:

Creating a New Template

Adding a New Template from the Gallery

Managing Templates

4

Contracts

You can upload new contracts to a specific vendor in your inventory.

When you upload a new contract, you are required to enter the following:

• Primary vendor

• Contract name

• Contract type

• Contract agreement created date

• Status of the contract

Once you complete the required fields, you have the option to complete additional fields as needed to add more details to your contract.

When you add a contract, it will appear on the Documents tab of its primary vendor, where it acts as a record of your organization's agreement with the associated vendor.

Engagements

You can add new engagements and connect them to a specific vendor in your inventory.

When you add a new engagement, you are required to enter the following:

• Engagement name

• Engagement organization

• Engagement type

• Engagement vendor

Once you complete the required fields, you have the option to complete additional fields as needed to add more details to your engagement.

When you add the engagement, it can be used to track risks and details more granular to the different services you are using from the vendor.

Use the following articles for more information:

Adding, Editing, and Deleting Contracts

Viewing Contract Activity History

Adding Engagements

Engagement and Contract Question Types FAQ

5

Vendor Workflows

Vendor Workflows allow you to quickly view and update where a vendor stands in your organization.

The three default system workflows provided by OneTrust can be cloned and deactivated if you do not want to use them.

Default and custom workflows help to automate and streamline vendor onboarding and evaluation across your organization.

Engagement Workflows

Engagements describe the way in which service is provided by a vendor. It can include things such as consulting, support, implementation, and more. The engagement is the record of time and resources allocated to a specific activity or service being provided by the vendor.

In the application, engagements can be evaluated using workflows and assessments to determine applicability and details.

You can customize these workflows in the same way as your Vendor workflows.

Familiarize yourself with the default options available and configure them to suit the needs of your organization using the below articles:

Configuring Vendor Workflows

Adding and Editing Vendor Workflows

Adding Vendor Workflow Rules

Adding Routing Logic to Vendor Workflows

Evaluating and Managing Engagements

For more vendor workflow/configuration articles click here.

6

Send the published questionnaires in your template gallery to internal teams or vendors as assessments.

• Send assessments to vendors via the vendor record, assessments tab, or self-service portal

• Set the respondent and/or approver workflow for these assessments

Utilizing the Exchange services you are able to request the Vendorpedia team to request completed assessments from the supplier from the provided list of options or you can also request for your own custom assessment to be completed (depending on the license purchased this may incur an additional cost). The Vendorpedia team will then provide status updates as to the completion of the assessment and once completed, then provide.

Use the following articles to help with this:

Launching an Assessment

Completing an Assessment

Viewing and Linking Inventory Assessments

Using the Self-Service Portal

7

Risk Workflows

You can use risk management workflows to track risks from the time they are identified to the time they are closed.

Review the workflow we have in place and get familiarized with the stages and functionality.

The below articles will help you:

About Risk Management Workflows

Adding and Managing Risk Categories

Setting Up Risk Scoring

For more vendor risk articles, click here

Controls

Controls are used to mitigate risks and can also be utilized in the risk workflow process, when going through the mitigation stage. You can review controls and perform self-assessments to see where they are useful to the organization, bring utilized correctly and being implemented correctly.

To leverage controls, they will need to be populated within the Controls Library. We can import standard frameworks such as:

• ISO 27001

• NIST

• AICPA SOC 2

• HIPAA and more

• Custom controls can be added manually or via a bulk import

For more details on Controls, use the below articles:

Adding, Editing, and Removing Vendor Controls

8

Automation rules help automate certain aspects of your vendor management workflow and allows you to launch assessments based on when specified criteria from the rules are met.

• You can create automation rules on the Automation Rules menu. When you add a new rule group, you are required to enter the rule group name and organization.

• Once you complete the required details, you can decide if you would like to enable the setting that allows the rule group to run only for items in your current organization.

• When your new rule group is created, you can add a frequency run, configure conditions, and set actions that meet the needs of your organization.

These new rules will be integrated into your workflow.

The below articles will help you with this:

Creating Automation Rules and Launching Assessments

Adding, Editing, and Deleting Third Party Risk Management Automation Rules

9

The concept of our reporting module is setup to pull in all the metadata based on the source data, and from there you can filter as needed. You can build custom excel and PDF reports pulling this data from an assessment or an inventory record.

The default vendor management dashboards show vendors grouped by risk level, the status of any vendor related assessments and the status of expiring vendor contracts. You can build custom widgets for the information that you wish to track, again pulling in all the metadata based on the source data.

For all reporting and dashboard articles, click here. However, for Vendor specific reporting articles, see below:

Using the TPRM Dashboard

Complete!

Congratulations on completing your implementation.