A business rule set to fire ‘after insert’ on the Vendor Contract table provides the most direct, immediate, and automated trigger. It ensures the assessment begins as soon as the vendor record is created, without manual intervention or delay, aligning with the requirement for automation before contract signing. Scheduled jobs introduce lag, UI Actions rely on user memory, and triggering on a status change adds an unnecessary manual step.

In VRM, ‘Accepted’ is a formal risk treatment strategy. It means the organization has consciously decided to acknowledge the risk’s existence and potential impact without investing resources in mitigation, often because the cost of mitigation outweighs the potential loss. It does not mean the work is done or the risk is gone; it remains on the register as an acknowledged exposure, which is crucial information for project planning.

Within an Assessment Process in VRM, you explicitly define Approval Groups. This configuration directly controls which individuals or roles have the authority to formally approve (sign off on) the completed assessment. This provides a clear, auditable trail of authorized approval, which is the specific control the auditor is inquiring about. While ACLs control general access, Approval Groups are the specific workflow element for assessment authorization.

A Trend Report is the native ServiceNow reporting tool designed to show how a metric (like Inherent and Residual Risk Score) changes over a defined period. It can plot both scores on the same chart, allowing for a clear visual comparison of their trends over the past year, perfectly meeting the CISO’s request. List reports show snapshots, gauges show current state, and Performance Analytics requires specific setup.

Custom questionnaires are the primary VRM mechanism for collecting structured, reportable data during an assessment. You can design questions with defined answer choices (e.g., ‘Yes/No/In Progress’, or a list of encryption standards). This ensures data consistency, enables easy filtering, aggregation, and reporting (e.g., ‘Show all vendors without a SOC 2 report’), which is not feasible with free-text fields or unstructured attachments.

The Policy and Compliance Management (PCM) application is specifically designed for this purpose. It allows you to import or create regulatory requirements (like the new one), map them to internal policies and controls, perform control assessments, and track gaps. While risks may be identified from gaps, the core activity of mapping regulations to controls is a PCM function.

A workflow triggered by a field change (like ‘Residual Risk Score’) on the Risk table is the most configurable and maintainable low-code/no-code solution. It allows you to easily set conditions (e.g., only if score increases), reliably identify the risk owner from the current record, and use the built-in notification activity. Business rule scripts are less maintainable, a dedicated ‘score change’ event may not exist, and scheduled jobs are inefficient and laggy.

The key distinction is temporal and about state. A Risk is a potential future event with uncertainty (e.g., ‘Potential for a breach if the server is unpatched’). An Issue is a present, actual problem or event that needs resolution (e.g., ‘The server IS unpatched’). Since the server currently lacks the patch, it is an existing problem (Issue) that also creates a future risk. This is a foundational concept for proper record classification.

The foundational configuration object for any assessment in VRM is the Assessment Definition. This is where you define the *process*: what is being assessed, the workflow (stages, due dates), who is involved (participants, approvers), and which questionnaires are used. You must create this definition before you can associate questionnaires to it or launch assessments, even if the asset class exists in the CMDB.

A business rule set to fire ‘after insert’ on the Vendor Contract table provides the most direct, immediate, and automated trigger. It ensures the assessment begins as soon as the vendor record is created, without manual intervention or delay, aligning with the requirement for automation before contract signing. Scheduled jobs introduce lag, UI Actions rely on user memory, and triggering on a status change adds an unnecessary manual step.0