Workflow Template

Supplier Risk Assessment Workflow

Collects a supplier risk assessment request, runs due diligence and (where applicable) security/privacy review, captures risk reviewer treatment and residual risk, routes it through risk manager approval with up to two rework cycles, and notifies the requester of the accepted outcome.

When a team wants to bring on a new supplier, someone usually has to chase down risk checks, security sign-off, and approvals across emails and spreadsheets before anyone can move forward. This workflow takes a supplier request straight through due diligence, routes it to security and privacy review when sensitive data or systems are involved, captures the risk reviewer's treatment plan and residual risk, and sends it to the risk manager for approval — with up to two rework cycles if changes are needed. Everyone involved works from tasks and forms in their inbox, while the record's status and timeline keep the whole assessment visible from submission to final acceptance.

Business Outcomes

Reduces time spent manually tracking supplier risk requests across email and spreadsheets
Helps ensure sensitive data suppliers get a security and privacy review before approval
Speeds up handoffs between due diligence, security review, and risk reviewer tasks
Gives the risk manager a clear approval point with structured rework cycles instead of ad-hoc back-and-forth
Keeps requesters informed automatically with acknowledgement and acceptance emails

Workflow Steps

Steps

1
Create Supplier Assessment Recordcreate record
Registers the submitted supplier risk assessment request as a record.
2
Set Status to Submittedupdate record
Sets the assessment status to Submitted.
3
Send Acknowledgement Emailsend email
Emails the requester an acknowledgement with their reference number.
4
Set Status to Due Diligenceupdate record
Sets the assessment status to Due Diligence.
5
Risk Team: Due Diligence Reviewcreate task
Assigns the risk team a task to record inherent risk and due diligence findings, due in 5 days.
6
Save Due Diligence Findingsupdate record
Persists the inherent risk rating and due diligence findings to the record.
7
Route on Sensitive Data/Systems Access
Checks whether the supplier accesses sensitive data or systems to decide if security and privacy review is needed.
accesses_sensitive_data: "Yes"→Set Status to Security & Privacy Review
Default→Set Status to Risk Review
8
Set Status to Security & Privacy Reviewupdate record
Sets the assessment status to Security & Privacy Review.
9
Security & Privacy Team: Reviewcreate task
Assigns the security and privacy team a task to record their findings and required controls, due in 5 days.
10
Save Security & Privacy Findingsupdate record
Persists the security and privacy findings and required controls to the record.
11
Set Status to Risk Reviewupdate record
Sets the assessment status to Risk Review.
12
Risk Reviewer: Risk Treatment Reviewcreate task
Assigns the risk reviewer a task to record the risk treatment, residual risk, and reassessment date, due in 3 days.
13
Save Risk Treatment Resultsupdate record
Persists the risk treatment, residual risk, and reassessment date to the record.
14
Set Status to Pending Approvalupdate record
Sets the assessment status to Pending Approval.
15
Risk Manager: Approve Residual Risk Acceptancerequest approvalrequires approval
Risk manager approves or rejects accepting the residual risk for this supplier.
16
Route on Risk Manager Decision
Routes the workflow based on the risk manager's approval decision.
approval_status: "approved"→Set Status to Accepted
approval_status: "rejected"→Send Back to Risk Reviewer
Default→End
17
Send Back to Risk Reviewerrestart from step
Restarts the workflow from the risk reviewer task so the treatment and residual risk can be revised.
18
Set Status to Acceptedupdate record
Sets the assessment status to Accepted.
19
Send Acceptance Email to Requestersend email
Emails the requester the residual risk rating and reassessment date now that the assessment is accepted.

Fields

Show all 15 fields

FormSupplier Risk Assessment Request

Requester Name*· Text
Requester Email*· Email
Supplier Name*· Text
Services Provided*· Long text
Criticality*· Choice
Does the supplier access sensitive data or systems?*· Choice
Systems/Data Accessed and Their Locations· Long text

TaskRisk Team: Due Diligence Review

Inherent Risk*· Choice
Due Diligence Findings*· Long text

TaskSecurity & Privacy Team: Review

Security & Privacy Findings*· Long text
Required Controls*· Long text

TaskRisk Reviewer: Risk Treatment Review

Risk Treatment*· Long text
Residual Risk*· Choice
Reassessment Date*· Date

Other fields

Assessment Status· Choice

Requester Name*
Requester Email*
Supplier Name*
Services Provided*
Criticality*
Does the supplier access sensitive data or systems?*

Forms

Supplier Risk Assessment Request

7 fields

Data Views

Supplier Risk Assessments

supplier_name, criticality, residual_risk, reassessment_date +1 more

Dashboard Widgets

Assessments by Status

Recommended integrations

Setup the following integrations to extend workflow capability.

Send email in the workflow
AWS SES

supplier risk assessmentvendor risk assessmentthird party risksupplier due diligencevendor management

Similar Workflows

Supplier Onboarding Workflow Supplier Performance Review Workflow Privacy Impact Assessment Workflow

Similar Categories

Finance & Procurement Cybersecurity & Privacy Governance & Compliance

FAQs

Do I need technical skills to set this workflow up?

No — this is a ready-to-use template, so your workspace can publish it in minutes and start running live supplier assessments right away. There's no installation or development project involved, so your team can start collecting requests the same day.

Can my team customise the steps or forms later?

Yes, you can change any part of the workflow by describing the change in plain English or editing the steps directly in the workflow editor. Earlier versions of the workflow are kept, so you can see what changed over time.

Who is actually involved in reviewing a supplier request?

The risk team handles the initial due diligence review, the security and privacy team steps in when sensitive data or systems access is flagged, a risk reviewer records the treatment plan and residual risk, and the risk manager gives final approval. Each of these is assigned as a task to a member of your workspace.

What happens if the risk manager doesn't approve the assessment?

If the risk manager rejects the residual risk acceptance, the workflow sends it back to the risk reviewer task so the treatment and residual risk can be revised. This can happen for up to two rework cycles, giving the reviewer a chance to adjust findings before the manager decides again.

Is this suitable for suppliers that don't touch sensitive data?

Yes — the workflow checks whether the supplier accesses sensitive data or systems and only routes to the security and privacy review step when that applies. Suppliers without that access move straight from due diligence into the risk reviewer's treatment review, keeping the process quicker for lower-risk cases.

Does the requester need to create an account to submit a request?

No, requesters submit through a public request form and never need to log in or hold an account. They're kept informed by email — first with an acknowledgement including their reference number, then with the final residual risk rating and reassessment date once the assessment is accepted.

What information gets saved on the supplier's record?

Because each of the review steps is one the workflow waits for, the inherent risk rating, due diligence findings, security and privacy findings, required controls, risk treatment, residual risk, and reassessment date are all saved directly on the record. You can see the full picture, along with the status and timeline, at any point in the process.

How do we track where a supplier assessment is at any given time?

Each request is a record with its own reference number, a status such as Due Diligence, Risk Review, or Pending Approval, and a timeline showing what's happened so far. Table views and dashboards let you see all your supplier assessments grouped by status at a glance.

Can we set our own deadlines for the review tasks?

The workflow includes default due dates — 5 days for due diligence, 5 days for security and privacy review, and 3 days for the risk reviewer's treatment review — but you can adjust these by editing the workflow steps. Changes apply going forward while keeping a record of earlier versions.

Ready to use this workflow?

Create a free account and customise this workflow for your business.