The vendor tiering process in ServiceNow Vendor Risk Management is designed to update the vendor's record only after the assessment is fully completed and finalized. The workflow dictates that when a tiering assessment record's state transitions to 'Closed', a business rule is triggered. This rule takes the calculated tiering value from the completed assessment and automatically populates it into the 'Tier' field on the corresponding vendor record. This ensures that the tier displayed on the vendor profile is always based on a finalized and approved assessment, not a draft or in-progress evaluation.

B. When the Tiering Assessment record state is Tiering Assessment: This state indicates the assessment is actively being worked on by the respondent. The final score and tier have not yet been determined, so the vendor record is not updated.

C. When all tiering assessments have been completed: The vendor tier is updated upon the closure of a single, specific tiering assessment. The system does not wait for multiple or "all" assessments to be completed.

1. ServiceNow Product Documentation - Vendor Risk Management: In the "Perform a vendor tiering assessment" section, the process is explicitly described. It states, "When the tiering assessment is in the Closed state, the Tier field on the vendor form is automatically populated with the tiering value from the assessment."

Source: ServiceNow Product Documentation, "Perform a vendor tiering assessment," Washington DC Release. (This behavior is consistent across recent releases like Utah and Vancouver).

The Template Designer in ServiceNow Vendor Risk Management is a graphical tool used to create and manage reusable templates. Its primary functions are to build Questionnaire Templates, which contain a series of questions for vendors, and Document Request Templates, which define the specific documents that must be collected from vendors. These templates standardize the data and evidence collection process during a vendor risk assessment, ensuring consistency and efficiency. They serve as the foundational building blocks for the assessment process.

B. Assessment Template: This is not a standard object created by the Template Designer. The designer creates the components (questionnaires, document requests) that are used within an assessment, not the assessment template itself.

C. Vendor Risk Assessment: A Vendor Risk Assessment is a specific, transactional record generated for a particular vendor. It is an instance of the assessment process, not a reusable template created in the designer.

1. ServiceNow Product Documentation - Create a VRM questionnaire template: "You can create questionnaire templates using the template designer. These templates can be used in vendor risk assessments to gather information from vendors." (ServiceNow Product Documentation for Vendor Risk Management, Vancouver release).

2. ServiceNow Product Documentation - Create a document request template: "You can create document request templates using the template designer. These templates can be used in vendor risk assessments to request specific documents from vendors." (ServiceNow Product Documentation for Vendor Risk Management, Vancouver release).

3. ServiceNow Now Learning - Vendor Risk Management (VRM) Fundamentals On Demand Course: Module: "Assessments," Section: "Questionnaires and Document Requests." This section details how the Template Designer is the tool for creating both Questionnaire Templates and Document Request Templates.

To evaluate a vendor on a recurring basis, a record must be configured in the Repeating Assessments table (asmtrepeatingassessment). This configuration defines the schedule (e.g., annually, quarterly), the assessment to be used (defined by an Assessment Metric Type), and the vendor(s) to be assessed. When the scheduled time arrives, the system automatically generates and assigns the assessment to the appropriate stakeholders. This process ensures consistent, automated, and periodic re-evaluation of vendor risk over time, which is a fundamental requirement for ongoing vendor management.

A. Repeating Surveys: While functionally similar, "Assessments" is the specific terminology and framework used within the ServiceNow GRC and Vendor Risk Management applications for formal evaluations.

B. Assessment Metric: This represents a single question or a specific item to be evaluated within an assessment, not the mechanism for scheduling the entire assessment to repeat.

D. Assessment Metric Type: This is a template that groups a set of related Assessment Metrics. It defines the "what" to assess, but not the "when" or the recurring schedule.

1. ServiceNow Product Documentation - Schedule a vendor risk assessment: "You can schedule vendor risk assessments to run automatically. For example, you can schedule an assessment to run on a quarterly or yearly basis... Navigate to All > Vendor Risk > Assessments > All Repeating Assessments and click New." This directly confirms that "Repeating Assessments" is the correct feature and table to configure for recurring evaluations.

2. ServiceNow Product Documentation - Assessment metric types: "Assessment metric types are templates that define a set of assessment metrics (questions)." This reference clarifies that a Metric Type is a template, not a schedule.

3. ServiceNow Product Documentation - Vendor risk assessments: "The Vendor Risk Assessment application enables you to create a set of questions in questionnaires to send to vendors to gather information and determine a risk score for that vendor." This provides the context that assessments, not surveys, are the primary tool in VRM.

The Vendor Risk Assessor role (snvdrriskasmt.vendorassessor) is focused on the execution and review of vendor risk assessments. A primary function is to access and analyze the completed assessments submitted by vendors to evaluate their risk posture. If the assessor identifies any risks, control deficiencies, or non-compliant answers during their review, they are responsible for creating issues to track these findings through remediation. While a Vendor Manager typically manages the vendor profile, an assessor creating a new assessment may need to create a new vendor contact record if the appropriate individual to receive the questionnaire does not yet exist in the system.

A. Enable communications across vendors: This is not a function of a risk assessor. The VRM application manages relationships with individual vendors, not communication between them.

C. Update vendor contract deadlines: This is a contract management function, typically performed by a Vendor Manager or Contract Manager, not a risk assessor whose focus is on risk evaluation.

1. ServiceNow Product Documentation - Vendor Risk Management roles: The snvdrriskasmt.vendorassessor role is defined as having the capability to "create and update vendor risk assessments, issues, and tasks. Can view all vendor risk information." This directly supports the functions of accessing assessments (B) and creating issues (D).

Source: ServiceNow Product Documentation, "Vendor Risk Management roles," Rome release (and subsequent).

2. ServiceNow Product Documentation - Review and approve a vendor risk assessment: This document outlines the assessor's workflow, stating, "When the vendor submits the questionnaire... The vendor risk assessor can now review the vendor's responses... If the assessor finds a problem with an answer, they can create an issue, a task, or request more information." This confirms the assessor's responsibility to access completed assessments (B) and create issues (D).

Source: ServiceNow Product Documentation, "Review and approve a vendor risk assessment," Utah release (and subsequent).

3. ServiceNow Product Documentation - Create and send a vendor risk assessment: The procedure for creating an assessment requires selecting a "Vendor contact." For an assessor to fulfill their duty of creating an assessment, a contact must exist. If the necessary contact is missing, creating one (E) becomes a required supporting task to complete their primary function.

Source: ServiceNow Product Documentation, "Create and send a vendor risk assessment," Utah release (and subsequent).

Vendor risk reports in ServiceNow are primarily generated from the core tables that store the essential data of the Vendor Risk Management (VRM) lifecycle. The Company [corecompany] table stores the vendor profiles, which is the foundation for all risk activities. The Vendor Risk Assessment [snvdrriskasmtassessment] table contains the records for each assessment, including its status, responses, and calculated risk scores. The Vendor Risk Issue [snvdrriskasmtissue] table tracks all issues identified during the assessment process that require remediation. Reporting on these three tables provides a comprehensive view of the vendor risk posture, assessment progress, and outstanding issues.

D. Vendor Contact [vmvendorcontact]: This table stores administrative contact information. While useful for communication, it is not a primary source for creating reports on vendor risk status or assessment outcomes.

E. Vendor Activity [vmvendoractivity]: This is not a standard, primary table used for substantive vendor risk reporting. Activities are typically tracked in journals or audit logs, not a dedicated reporting table of this name.

1. ServiceNow Product Documentation - Components installed with Vendor Risk Management: This document lists the key tables installed with the VRM application. It explicitly mentions snvdrriskasmtassessment (Vendor Risk Assessment) and snvdrriskasmtissue (Vendor Risk Issue) as core components. The corecompany table is the base for defining vendors.

Reference: ServiceNow Product Documentation, "Components installed with Vendor Risk Management," section "Tables."

2. ServiceNow Product Documentation - Vendor Risk Management dashboards and reports: The pre-configured dashboards and reports for VRM are built using these core tables. For example, the "Vendor Risk Overview" dashboard pulls data from vendors (corecompany), assessments (snvdrriskasmtassessment), and issues (snvdrriskasmtissue) to provide a holistic view.

Reference: ServiceNow Product Documentation, "Vendor Risk Management dashboards and reports," section "Vendor Risk Overview dashboard."

3. ServiceNow Product Documentation - Create a vendor: This guide confirms that vendors are stored in the Company [corecompany] table and are distinguished by the "Vendor" flag being set to true. This establishes it as the foundational table for any vendor-related reporting.

Reference: ServiceNow Product Documentation, "Create a vendor in Vendor Risk Management."