Predictive Risk Profile
Hello, it would be great if a possibility would exist in the Predictive Risk profile to : - Have a focussed Security Risk Profile that collects infomration on open source OWASP Tools and available sources, Like: 1. Cloudflare URL scanner Radar/ URLSCAN.io / (to have detected technologiies and security warnings) 2. Shodan.io (main observations of the URL) 3. Cert.sh to have Certificate infos 4. Collect Trust Center information (to analyze a set of main existing documents to better align ascoring with evidence) An Subdomain listing and detection where as well Login pages and Exposure can be seen. This section could be called URL and Domain Risk Profile or Security public Risk Profile Alterantively if the predictive Risk Profile could be run with a Focus and Context: Security focussed/ Economic Focusses/ Compliance Focussed etc. Regards
Pre-view submitted external registration form
Once the external registration form is approved by assigned approvers, the next step is registering the third-party in the third-party catalogue. However, certain data (for example, the nature of the relationship based on which the location of the third party within the organisation can be determined) is not visible since the external form (once submitted) cannot be viewed by the coordinator. Having the possibility to view the pre-submitted data or having the “custom fields” tab visible with the data pre-filled from the external form when creating a third party would help a lot.
Enable direct navigation from Messages to related Issues and Action Plans
From the Messages tab (see attachment), I would like to be able to directly click through to the referenced issue or action plan. This would allow users to open the related item immediately, without having to search for or open it manually.
Request for External Questionnaires' exportability
We kindly request that you consider implementing a functionality allowing EQ submitters to export their completed answers. This feature would significantly support our intermediaries in reviewing their submissions and ensure greater efficiency and transparency during the due diligence process. This feature has been requested by a number of our intermediaries. Many thanks!
Request: Enable shared filters (filter sets) that can be saved and reused by all users.
Users should be able to create and save predefined filter sets with standard settings (e.g. period, type, status). When creating a filter set, a user can select an option to share it with others, so everyone can apply the same filters with one click. Value: Consistent reporting and analysis Less manual work and fewer errors Faster insights and better collaboration
Feature Request: Temporary / Deputy Risk Owner
We would like to request the ability to assign a Temporary (Deputy) Risk Owner within 3rdRisk for a defined period of time (vacation etc). Requirement: The Primary Risk Owner remains unchanged A Temporary / Deputy Risk Owner can be assigned. The assignment is valid from date X to date Y. The temporary role activates and deactivates automatically based on the selected dates. During the active period: The deputy receives all notifications and alerts. New issues and tasks are also assigned/visible to the deputy. The deputy can manage and update issues. All actions remain fully audit logged. Benefits: No permanent ownership changes. No manual reassignment of issues. Fully audit-proof (“who was responsible when”). Ensures business continuity during short absences (1–2 weeks).
Customizable Email Notification Preferences in 3rdRisk
As a 3rdRisk user, I would like the ability to customize my email notification settings, including which types of notifications I receive, with optional approval from a team manager. This would help prevent unnecessary emails being sent for every issue, action plan, and linkage created in the system. Description Currently, users receive multiple email notifications for every new issue, action plan, and linkage in 3rdRisk. This can lead to email overload and makes it harder to focus on the updates that are truly relevant. To improve usability and reduce notification fatigue, users should be able to configure their personal email preferences. Examples of configurable settings could include: Turning specific categories of notifications on or off (e.g., “Issues”, “Action Plans”, “Linkages”). Adjusting frequency (e.g., immediate, daily digest, weekly digest). Applying approval workflows (e.g., changes require authorization from a team manager). Additionally, to enhance clarity and efficiency, email subject lines should clearly state which specific issue or action plan the notification refers to. This prevents users from having to open multiple emails to understand what each one is about.
Bulk import issues
Bulk import option An option is added to bulk import issues. You can upload an Excel file with all your issues and fill in the fields in the template. You can also assign the third-party directly through this file. Excel template You can download an Excel template and fill it out using your existing data.
Enable filtering and exporting by issue subtypes
As a report user, I want to filter and export issues based on their subtypes, so that the distinction between types and subtypes is reflected in our reports and analytics. Acceptance Criteria: Users can filter issues by subtype in the issue view. Users can include subtypes when exporting issue data. Reports and exports accurately reflect the type and subtype distinctions.
Feature Request: Approval Workflow for Closing Action Plans
Description: Currently, action plans within the system can be closed directly by the person to act, without any intermediate approval step from the team lead. For quality assurance and risk mitigation, we would like to introduce an optional approval workflow. Requested Enhancement: Enable a configuration option that requires team lead approval before an action plan can be closed. This approval step should apply at minimum to action plans with severity levels High and Critical. If possible, we would also welcome the option to enable this approval flow for action plans of any severity level.
Approval Workflow for Closing Action Plans
Add Team Lead Approval Requirement Before Closing High‑ and Critical‑Severity Action Plans Currently, action plans within the system can be closed directly by the person to act, without any intermediate approval step from the team lead. For quality assurance and risk mitigation, we would like to introduce an optional approval workflow. Enable a configuration option that requires team lead approval before an action plan can be closed. This approval step should apply at minimum to action plans with severity levels High and Critical. If possible, we would also welcome the option to enable this approval flow for action plans of any severity level.
Bulk cancelling of Assessments in Ecosystem
Hi Team is it feasible to create a feature to cancel assessment in bulk?
Add Document Types
Pending the redesign of the Document Types list (which should be made configurable per tenant), please add the following list of Document Types for Oney Insurance (both Sandbox and Prod) TPA IPID GTC Brokerage Agreement TPA & Brokerage Agreement Product Appendix TPA & Product Appendix Termination Agreement Legal Partenariat de courtage et de gestion Contrat cadre de courtage et de gestion Insurance Intermediation Agreement Intermediation Agreement Distribution and Administration Protocol Reinsurance Treaty Partnership Agreement Brokerage and Third Party Administration Protocol
Review on Contracts 2nd iteration
Could the Review functionality on Contracts be expanded with more functionality? The following is requested by De Goudse: Multiple templates: Currently it is only possible to have 1 template with review procedure. However, in some cases there are different reviews. Would it be possible to create multiple templates and schedule them? Deleting of reviews: Currently it is not possible to delete reviews Add title of review: Please add the ability to create a custom title of the review Add criticality: Please allow the possibilty to add low/medium/high/critical to a review Improve data table of reviews: Please take into account the title and criticality Bulk creation: Please allow the ability to create contract reviews in bulk Note: This request also applies to the Contract function at Third-Party level.
Make Document Upload Types Customisable per Tenant
Suppliers or platform users that want to upload a document, can choose between more than 30 document types. Regardless this huge number, there are still (new) customers that require more document types to be added. Therefore it would be helpful if each customer can define their own document types to be used by suppliers and themselves in the backend.
Remove/archive contracts
While it is possible to archive/remove third parties, the contract usually are left behind in the system (not linked, just hanging in the air). It would be helpful if it were possible to archive/delete the contracts.
Export external form (business registration form)
Hi, the current external form (business registration) (which appears as “custom fields” in the overview of the third party when editing) cannot be exported. It would be great to have the ability to export the contents of the form for audit trail
Dashboard - actions
In your dashboard you see all you actions - but our actions can be Internal Control related or Risk register action related. Is it possible to make a distinction between the two. So that people will not mix the two up (and yess that is possible).
Custom Issue Statuses
As an administrator, I want to define custom issue statuses so that incident management reflects real-life scenarios and supports clearer reporting and workflows. Current Situation The current incident workflow only supports three fixed statuses: Open, In Progress, and Closed. These options are too limited for many organizations and do not represent several common real-world outcomes—for example: Reported in Error Withdrawn Pending Review Awaiting Third-Party Response Because these statuses cannot be added, users often misclassify incidents or force them into incorrect categories. This reduces the accuracy of incident reporting, complicates analysis, and creates inconsistencies in the incident lifecycle. Desired Situation Administrators should be able to configure these additional incident statuses in the platform’s settings. This enhancement will enable users to reflect their actual internal processes and classify incidents accurately.