Third-Party Risk Management Workflows FAQ

Vendor workflows and workflow stages offer ways to quickly view and update where a vendor stands in your organization.

For example, you may be in the process of onboarding, offboarding, or rejecting a vendor.

To configure vendor workflows and stages, navigate to the Workflows tab of the Third-Party Risk Management module and select Vendor Workflows. You have the ability to add new workflows or clone, publish, and archive existing workflows.

You can configure different stages to be included within each workflow and remove created stages at any time. The items that can be configured include:

• Stage Badge Colors

• Stage Names

• Stage Descriptions

For more information, see Adding and Editing Vendor Workflows.

The default workflow is the workflow set to your vendor when the vendor is added for the first time. The vendor will begin in the first stage of the workflow. You can manage which workflow you want as your default at any time via the Third-Party Risk Management Workflows screen.

For more information, see Adding and Editing Vendor Workflows.

OneTrust has provided three default system workflows for your use. These workflows can be cloned and deactivated if you do not want to use them.

For more information on cloning or deactivating workflows, see Adding and Editing Vendor Workflows.

Standard offboarding in OneTrust leverages OOTB workflows and checklists to simplify and standardize vendor offboarding and deprovisioning.

Offboarding is initiated through configurable triggers such as contract or engagement expiration, incident severity, performance breaches, or risk posture changes, including events sourced from upstream S2P or ERP systems. Any of these events can launch offboarding workflows automatically through automation and workflows rule configuration.

Third parties are moved to an offboarding specific workflow which guides internal users and the vendor through pre-determined steps to ensure complete termination of business, technical, and data connection. Workflows feature standardized tasks, assessments, approvals, and escalations to defined owners and collaborators.

Yes. Out‑of‑the‑box offboarding checklists cover standard data and contractual obligations and makes it easy for a vendor to attest and attach evidence of adherence. Customer checklists can be easily configured to match your organization’s needs.

The vendor portal collects attestations and artifacts confirming data return or deletion, with all evidence stored on the third‑party record for easy auditability.

Preconfigured integrations notify downstream business systems to disable access, halt purchasing, and confirm deprovisioning across associated products and services.

Your vendors are migrated to certain workflows and stages based on their status.

The vendor or engagement workflow rule configured will be triggered if:

• Updates are made on a vendor or engagement record.

• Bulk updates are made to vendor or engagement records on the list screens.

• Updates are made on the parent of a vendor via global/local records when attribute syncing is enabled.

• The vendor or engagement risk level or risk score change due to risk updates.

• The vendor or engagement organization is deleted.

• The vendor or engagement status is changed.

The vendor or engagement workflow rule configured will not be triggered if:

• You manually change the vendor or engagement stage.

• You manually change the vendor or engagement workflow.

• Updates are made using the Update Third Parties import template.

• Updates are made using the Update Vendors import template.

• Updates are made using the Update Engagements import template.

• Updates are made to a vendor or engagement via an assessment.

For more information, Adding Workflow Rules to Vendor Workflows.

The ability to change workflows using vendor and engagement workflows rules is available as a preview feature in the 202308.2.0 release. To enable access to this feature, please contact OneTrust Support to submit the request.

For more information, see Adding Workflow Rules to Vendor Workflows and Adding Workflow Rules to Engagement Workflows.

Workflow rules are evaluated in sequential order. The first rule that meets all the conditions will advance the workflow to the stage specified in that rule.

No. There's a validation check that will prevent sending duplicate assessments when the vendor still has an open assessment using the same template.

The assessment would not be sent since there is no valid respondent assigned to the assessment.

The user would be replaced with their manager and if no manager assigned, the user would be replaced with the default approver of the organization.

When a vendor reaches the stage, the action will automatically be taken and will not validate against conditions.

The stage rules are evaluated asynchronously.

The next stage rule will be evaluated.

No. When using the workflow stage rule to launch an assessment, the assessment will not launch if an existing one is open using the same template.

If you have used the same assessment template, the report is sent using the last completed assessment only.

When an engagement is created manually in the platform, the Engagement Created trigger will advance the workflow stage as expected. When an engagement is created via the API, the rule does not trigger and the workflow remains in the current stage.