VRM Fundamentals and Review
About 24% of the CIS-TPRM exam — see all 7 domains.
What the product does
ServiceNow Third-party Risk Management provides a centralized process for managing your portfolio of third parties and their engagements, assessing and scoring risk, and performing remediation. Key capabilities: onboarding, offboarding, renewal, and other due diligence workflows; assessment management; continuous risk monitoring; and risk performance management.
VRM to TPRM rename and scope
The application was renamed from Vendor Risk Management to Third-party Risk Management in the Vancouver release. The rename brought the due diligence request workflow and internal assessments, relabeled Third-party Scores as Risk Intelligence Scores, and replaced "vendor" with "third party" in the UI. A third party is any organization or individual you interact or have a business relationship with: vendors are one type, alongside suppliers, affiliates, consultants, partners, resellers, distributors, outsourced staff, and even customers and clients.
Third parties, engagements, subsidiaries, fourth parties, and tiers
- Third party is a Company [core_company] record; every third party must be categorized as a Vendor in that table.
- Engagement [sn_vdr_risk_asmt_vendor_engagement] is the informal or contracted relationship you intend to form with a third party, describing the services or products provided. One third party can have many engagements, and issues, tasks, internal assessments, and external assessments are associated with engagements.
- Subsidiaries are organizations owned or controlled by the third party; their ratings contribute to the controlling third party's score.
- Fourth through nth parties contract with a third party (they are not owned by it) and are tracked on the third party's Downstream suppliers tab.
- Third-party elements (facility, principal, product, other, and AI use cases or models) are what a third party or engagement relies on, and can be collected and assessed during due diligence.
- Tiers and ratings: internal assessments calculate third-party and engagement tiers and the risk rating (Zurich renamed the Tier-level column to Risk rating). The IRQ process replaces the original tiering assessment process; risk tiering remains supported as a legacy process.
Inherent Risk Questionnaires (IRQs) and due diligence
An Inherent Risk Questionnaire (IRQ) is answered by internal employees during the internal assessment to assess inherent risk (risk before mitigation), considering factors such as the nature of the services, data sensitivity, geographic location, and security posture. The results decide whether to engage, what level of due diligence is required, and which external questionnaires to send. In the classic engine, IRQ responses or the IRQ-calculated tier can automatically attach external questionnaires (not supported in SAE).
The due diligence workflow (Due diligence request workflow application [com.sn_tprm_dd]) runs these processes in order:
- Request: an employee raises a due diligence request in Employee Center to onboard a new engagement, reassess an engagement, reassess for contract renewal, or offboard an engagement with or without due diligence. The Due diligence request assignment group assigns a TPR manager or TPR assessor as owner, who scopes and approves or rejects it.
- IRQ process: the owner attaches an IRQ to an internal assessment; the IRQ assessor (an internal user named on the request) responds; the owner reviews and closes it.
- Third-party element collection (optional).
- Due diligence: external assessments are sent to the third-party contact and the engagement contact; issues and tasks are raised as needed; the request reaches Ready for TPRM approval.
- Approval: approvers (TPR approver role) review and approve or reject; closing the approved request makes the third party or engagement Active.
- Contract risk process (optional): the contract negotiator executes, skips, or rejects the contract.
Sample questions from this domain
Three of the 72 in this domain, with the reasoning. The full set is in the question bank.
Within the ServiceNow GRC/IRM product family, which application is purpose-built to manage the risk an organization inherits from its vendors and third parties?
- A. Business Continuity Management (BCM)
- B. Third-party Risk Management (TPRM) ✓
- C. Operational Resilience Management
- D. Policy and Compliance Management
Why: Third-party Risk Management (TPRM) (formerly Vendor Risk Management, renamed in the Vancouver release) is the GRC application built to identify, assess, and mitigate the risk that third parties introduce. Business Continuity Management plans recovery from disruptions, Operational Resilience Management tracks the resilience of business services, and Policy and Compliance Management governs internal policies, controls, and compliance; none of them manages the third-party portfolio.
Third-party Risk Management (TPRM, formerly VRM) is built on which foundational ServiceNow capability that also underpins Policy and Compliance and Risk Management?
- A. The ITSM task framework (incident, problem, and change management records)
- B. The Customer Service Management account model (account, contact, and case records)
- C. The Now Platform GRC/IRM common core (risk, control, and assessment framework) ✓
- D. The Supplier Lifecycle Operations supplier model (supplier, contact, and onboarding)
Why: TPRM is one of the Governance, Risk, and Compliance (GRC) products and reuses the shared GRC core: its engagements relate to risks [sn_risk_risk] from Risk Management and controls [sn_compliance_control] from Policy and Compliance Management, and its questionnaires use the platform assessment tables. The ITSM incident, problem, and change framework, the Customer Service Management account and case model, and the Supplier Lifecycle Operations supplier onboarding model are not what Policy and Compliance and Risk Management are built on.
A customer wants to understand which record represents a company that supplies goods or services and that Third-party Risk Management (TPRM) tracks for risk. Which core record type is used as the central party in the third-party portfolio?
- A. Engagement record (relationship to the third party)
- B. Third-party record (Company [core_company]) ✓
- C. Third-party contact (vendor_contact user)
- D. Due diligence request record [sn_tprm_dd_request]
Why: The third-party record, stored in the Company [core_company] table, is the central party in TPRM: contacts, subsidiaries, engagements, internal and external assessments, issues, and tasks all relate to it. An engagement is the relationship you intend to form with that third party, not the party itself; a third-party contact is a person at the third party who responds in the portal; and a due diligence request drives the onboarding, reassessment, or offboarding workflow.