Third-Party Risk Management Automation Rules Use Cases
You can create and configure inventory rules to automatically launch assessments, send emails, and send reports. To create an automation rule, see Adding, Editing, and Deleting Third-Party Risk Management Automation Rules.
This article provides several automation rule use cases that can be used to help configure automation rules for a specific purpose.
Annual Reassessments
The purpose of this configuration is to send annual reassessments to vendors that meet a specific risk threshold. A similar rule can be created to send a reassessment every 2-3 years for lower risk vendors.
Rule Explanation
-
This condition and action combination can be configured to see if a vendor with high or very high aggregate risk scores has completed a particular assessment within the past year. If this is true, it will send a reassessment of the same template to the previous assessment's respondents with all the latest values of the vendor updated.
-
If the vendor has never completed this assessment and meets a specific risk threshold, it will still evaluate this condition to be TRUE so that it can be combined with the Send New Blank Assessment if no Assessment Found scenarios.
-
The purpose of the Send New Blank Assessment if no Assessments Found is to guarantee a vendor has completed an assessment of a particular template if it is a mandatory part of the vendor workflow. In the screenshot above, the Send New Blank Assessment if No Assessment is Found is left unchecked, this means the automation rule WILL NOT send a blank assessment to vendors that do not already have an in progress or completed assessment template named in the automation rule Action.
Additional Information for Send New Blank Assessment if No Assessment is Found
The following tips provide more insight on how Send New Blank Assessment if No Assessment is Found works using an annual vendor reassessment as an example.
-
In the example above, If a vendor has never completed an assessment for the Template named in the Condition then the rule Action will be executed.
Additionally, if Send New Blank Assessment if No Assessment is Found is NOT selected in the Action AND the vendor does not have a completed assessment from the Templatenamed in the rule Action , then the vendor WILL NOT receive an assessment for the Template named in the Action.
On the other hand, if Send New Blank Assessment if No Assessment is Found is not selected and the vendor DOES have a completed assessment, then the Vendor will receive an assessment from the template named in the rule action.
-
If the Send New Blank Assessment if No Assessment is Found is selected, the automation rule WILL send a blank assessment from the template named in the rule action to vendors that do not already have an in progress or completed assessment for the Template named in the automation rule Action.
-
If Copy Previous Assessment is not enabled, the automation rule WILL send a blank assessment for the Template named in the rule Action to vendors that do not already have the assessment in progress or completed, functioning as if the Send New Blank Assessment if No Assessment is Found is selected.
Monthly Report
The purpose of this configuration is to send a monthly PDF report on all vendors that meet a specific condition. In the example below, a report is sent if a vendor has a Payment Card Industry Data Security Standard (PCI DSS) expiration approaching within the next 30 days.
Rule Explanation
-
This condition and action combination can be configured to send a report to an internal user when the PCI DSS expiration date is within 30 days. The frequency should be set to the first of the month, monthly.
We recommend using 45 as the number value in the conditions block to capture expiration dates that fall on the first week of the upcoming month. For example, if a vendors PCI DSS expiration is March 2 and the rule is configured to check 30 days ahead of time, the user would not receive a report until March 1. This would only give the user one day to take action.
Contracts Expiring Notification
Contracts with an Expired, Terminated, or On Hold status are not considered for automation rule evaluations.
Contracts belonging to an Archived vendor record will not be considered for automation rule evaluations.
The purpose of this configuration is to send an email notification to a user so that the user can review and take action 90 days prior to a contract's expiration date.
Rule Explanation
-
This condition and action combination can be configured to send an email to a user when the contract expiration date is within 90 days. The frequency should be set to daily so that the expiration dates of the contracts can be evaluated each day.
We recommend similar conditions be configured for 30 and 60 days so that a reminder email is sent to users on a monthly basis up to three months prior to the contract expiring.