Third-Party Security Assessment Workflow

What happens if a vendor doesn't respond to the security questionnaire?

The assessment record stays in Open status until questionnaire responses are persisted, so nothing silently disappears. You can configure reminder notifications inside assess.one to nudge vendors automatically, and reviewers can see at a glance which vendors are outstanding. The workflow doesn't force a deadline by default, but you can add a due date and escalation step directly in the template editor.

Can this handle a vendor that fails the risk review multiple times?

Yes. The workflow explicitly supports looping — if residual risk approval is rejected, the record updates status, notifies the vendor of required remediation, and restarts the review after remediation is submitted. This cycle can repeat as many times as needed until the risk is resolved or the assessment is formally closed out.

What if we need different approval logic for high-risk vendors versus low-risk ones?

You can customise the approval routing step directly in assess.one to branch based on risk score, vendor tier, or data-access level. This lets you require multiple approvers for high-risk vendors while keeping low-risk approvals single-step, all without any code changes.

Who needs access to this workflow?

Typically vendor owners or procurement staff create the assessment record, security reviewers evaluate evidence and log findings, and a designated approver signs off on residual risk. Vendors themselves only need access to the questionnaire link — they don't need a full platform account. Access and permissions for each step are configured inside assess.one's role settings.

How does the reassessment date get set, and can we change the interval?

Once an assessment is approved, the workflow automatically sets a reassessment due date and persists it to the vendor record. The default interval is configurable — you can set it to 6 months, 12 months, or any cadence your compliance policy requires, directly in the workflow settings.

What if we have vendors with multiple services or data-access levels to assess separately?

Each vendor assessment is created as its own record during intake, so you can run separate assessments per service or data-access scope for the same vendor. This keeps risk findings and approval history distinct per engagement rather than lumped into one blanket vendor rating.

How long does it take to get this workflow live?

Publishing the template takes minutes — there's no implementation project or software installation required. Once published, your team can immediately start creating vendor assessment records and sending questionnaires in the same session.

Can we customise the security questionnaire itself?

Yes. The questionnaire content, fields, and scoring logic can be edited directly within assess.one before it's sent to vendors. You can tailor questions to your specific compliance framework, such as SOC 2, ISO 27001, or internal risk criteria.

What happens at the residual risk approval decision point?

After internal review, the workflow routes the record to a designated approver who evaluates the documented risk findings and remediation notes. If approved, the system records the decision and sets a reassessment date; if rejected, it flags the vendor for remediation and loops the assessment back for re-review.

Does this workflow support compliance audit requirements?

Every step — questionnaire responses, review findings, approval decisions, and reassessment dates — is persisted to the vendor record, creating a complete audit trail. This makes it straightforward to demonstrate to auditors when and how each vendor's risk was assessed and approved.