Assessment Configuration

This is the single heaviest domain. Master how assessments are built, generated, scored, and progressed through their life cycle.

Building blocks: templates, questionnaires, document requests

A third-party risk assessment is a set of questionnaires sent to third-party contacts or internal users. One sent to internal users is an internal assessment (in Zurich, tiering assessments are named internal assessments); one sent to a third-party contact is an external assessment (number prefix VRA). External assessments combine questionnaires (questions the third party answers) and document requests (artifacts such as SOC 2 reports that the third party uploads). Both feed the assessment rating.

Assessment templates are reusable groupings of questionnaire templates and document request templates, so the same set can be sent to similar third parties in future assessments. The TPR admin defines questionnaire and document request templates; the TPR manager groups them into assessment templates. Scoring is configured separately, in the scoring setup (risk domains, criteria, and scoring rules) and the risk rating scale. Do not change a questionnaire template after it has been sent; duplicate it instead.

TPRM supports the SIG (Standardized Information Gathering) questionnaire from Shared Assessments through the GRC: SIG Questionnaire Integration (SIG Full, Core, and Lite templates). The sample SIG templates do not include correct answers, so you define correct answers and scoring yourself. Third-party contacts can also answer with a Microsoft Excel template and import it in the portal.

Risk domains (risk areas) and weighting

A risk domain (called a risk area on forms and in some applications) defines a type of risk to assess, for example security risk for a data-management third party or financial risk for a bank. Each risk domain definition has a default scoring method (Average Risk, Max Risk, or Min Risk) and a default weight. Risk area criteria group the risk domains that apply to a type of third party or engagement, and component criteria weight the components (for a third party: external risk assessments, subsidiaries, engagements, risk intelligence rating). Scoring rules apply the criteria to third parties and engagements and roll ratings up with MIN, MAX, or AVG.

Scoring and rating calculations (classic engine)

Under the classic assessment engine, each question gets a rating from its response (scored questions are 0 or 1), a percent contribution from its weight within the category, and a normalized value (100 x rating x percent contribution). A category rating is the sum of its questions' normalized values, and the category normalized value is the category rating multiplied by the category weight. The questionnaire score is the sum of the normalized category scores, and the assessment rating is the weighted average of the questionnaires and document requests within each risk area, with weights set by the risk area scoring method. Only answered questions count. If a third party or engagement is associated with a business service in the Service [cmdb_ci_service] table, that service's criticality weight (Business Service Rating Scale, 1 most critical to 4 not critical) is factored in.

The score is mapped to a rating through the risk rating scale. The base system has five ratings with configurable minimum and maximum values; Zurich forms show Critical, High, Moderate, Low, Minor. In the default settings, scores of 20 through 39 indicate high risk and 60 through 79 indicate low risk.

Watch the direction of the scale. A higher score means lower risk: a score near 0 maps to Critical, a score near 100 maps to Minor.

Smart Assessment Engine (SAE)

The Smart Assessment Engine is the GRC-wide assessment engine. In TPRM it is turned on with the Smart Assessment Engine enabled [sn_vdr_risk_asmt.sae_enabled] property, and the change cannot be reversed; after that, new assessments must use SAE templates, created in the Vendor Management Workspace. Classic configuration is still documented in Zurich for instances that have not switched.

Key SAE points for TPRM:

• Templates have sections and subsections, reference information, conditional visibility, auto-save, a duration, and a template-level risk rating scale; TPRM SAE templates add the risk area and the Include previous responses option.
• Scoring can be configured at question, subsection, section, and assessment levels, with optional normalization.
• Question-level comments, work notes, and flags are available to reviewers.
• Limitations: no issues from the View responses page (use issue generation rules), no signature feature, no automatic attachment of external questionnaires from IRQ responses or IRQ-calculated tiers, no Excel export in the portal, unsupported question types (percentage, ranking, image scale, custom metric), and no repeating assessments (use event-driven management rules).

Assessment generation, scheduling, and automation rules

Assessments can be created manually or by rules:

• Tier-based rules tie a third-party tier to an assessment template.
• Provider-based submission rules act when a risk intelligence provider's score or rating changes (by percentage, score, threshold, or rating); the action can create and send an assessment, an issue, a task, or an email.
• Event-driven management rules generate and send questionnaires and document requests to third parties or engagements that meet defined criteria, with a one-time, recurring, or on-demand run type. They can also start reassessment, renewal, or offboarding due diligence, but not onboarding. With SAE they replace repeating assessments.
• Assessment scheduling (formerly Repeating assessments) is the classic-engine way to recur an assessment for a third party or engagement.
• Issue generation rules create issues from responses to selected questions when the assessment moves to Generating observations.

With SAE enabled, tier-based, provider-based, event-driven, and issue generation rules run only for assessment templates marked Supports smart assessment.

External assessment life cycle states

Draft, then Submitted to third party, Responses received, Generating observations, Finalizing with a third party, and Closed. During Submitted to third party the third party works the questionnaires, tasks, and issues. In Generating observations the system can auto-generate issues; in Finalizing with a third party the team reviews all data and can reset to Draft. Closing an assessment for an engagement that will be contracted starts the contract risk process.

Do not confuse record types. Classic questionnaire requests (formerly assessment instances) use Ready to take, In progress, Complete, Canceled; classic questionnaires use New, Submitted, In Progress, Received, Returned, Canceled; SAE questionnaires use In progress, Completed, Canceled. Third-party risk issues start in New and close as Closed Complete, Closed Incomplete, or Closed Cancelled.

---