We are hosting our annual Summer Meet-Up on the 10th of September in Amsterdam, RSVP today!

Another month another update!

Back in July we teased that assessments were getting conditional logic and autofill. Both are here, along with plenty of other exciting changes. Our team has been hard at work, so, without further ado, let’s dive into the latest batch of changes.

Key changes

Assessments

Questionnaire builder: If you have ever opened a four-sheet Excel template and hoped the row references still lined up, this one is for you. Questionnaires are now built in the platform. Set your domains, questions, weights and scoring, preview the whole thing exactly as a supplier will see it, then publish.

Existing and in-use questionnaires can easily be duplicated it and edited. Everything currently running carries on undisturbed.

Conditional questions: Not every question applies to every supplier. Asking anyway wastes their time and gives you answers that aren’t actually useful. But not including the question altogether means you might miss out on answers from relevant suppliers.

Questions can now stay hidden until an earlier answer makes them relevant. For example, asking whether a supplier processes personal data brings up the follow-ups only when the answer is yes. Hidden questions are not scored and never reach your exports, so nobody is marked down for a question that was never theirs.

Answers carried over: Your suppliers may be the only group of people that dislike reassessment season more than you. Responding to the same questions with the same answers gets tiresome after a while.

Which is why from now on when a questionnaire they have completed before comes round again on the same contract, the supplier portal now offers to fill it in from their last finished assessment.

They get a prompt on each questionnaire, answers carry across while comments and attachments do not, and every field that was filled in is marked with a blue border so they know exactly what to check before submitting.

A copy for the supplier: Until now, a third party filled in an assessment and kept nothing. From now on when they are done, they get to take their answers with them, either downloading a PDF straight away or having one emailed to the address the invite went to. Emailed copies are password protected, with the password sent separately.

The PDF follows your branding and lists every questionnaire, domain, question, answer and comment, so they have something to work from next time round. Consider it a useful souvenir for your vendors.

A few smaller things: Questionnaire details are now visible from inside an assessment, you can set the next assessment date while you are finalising the current one, and exports have been extended to cover questionnaires you have since archived.

Business impact analysis

A risk profile for your own organisation: Within our platform, it is easy to see which of your suppliers are critical. Knowing the same about your own processes is a harder question, and far too often the answer ends up living in a spreadsheet that stopped being accurate a week after it was built.

Every organisation element with an active CIA domain now sits in one table: confidentiality, integrity and availability scored side by side, who assessed and reviewed it, what is linked to it, and when the next review is due. Overdue ones tell you how late they are.

Assessments on any element: Each element in your organisation model has its own assessments now, with an assessor, a reviewer, dates, and a notification when it is the reviewer's turn. More than one template can run against the same element, so a facility can carry a business impact analysis alongside whatever else it needs.

A template to start from: Building a BIA from a blank page can be a pain, and hardly anybody's idea of a good week. That’s why we provide you with a ready-made one covering confidentiality, integrity and availability across 13 scored questions, available to everyone from the start.

Wider coverage: Multi-domain assessments now run against far more of your organisation: assets, processes, key services, facilities, departments, value chains, factories and warehouses.

Third-party catalogue

Link a risk where you are: Adding a risk used to send you off to the risk register, and linking an existing one was not possible at all. Both can now happen from the third party itself.

See what is due next: The next review date is a column you can sort on, so finding everything due this month takes a click rather than opening records one at a time.

Find what is missing: Filter the catalogue by whether a document type is there or not. Finding the twelve suppliers without a current certificate stops being an afternoon's work.

And two more: Documents can now carry tags, the same way third parties do, and every column in the catalogue can be clicked for sorting.

Contracts

Duration types: Tacit renewal is easy to miss, right up to the point where it is too late to do anything about it. Contracts can now be indefinite, fixed-term with tacit renewal, or fixed-term without.

A tacitly renewed contract extends its own end date and nudges you 90 days before the notice deadline, while there is still something you can do about it.

Prompts that follow your notice period: The renew-or-exit prompt works back from the notice deadline rather than the contract end date. If you owe three months' notice, you hear about it with three months to go.

EBA fields in imports: Contract imports now include the EBA compliance fields, matching what DORA already supported, so your register can go out and come back without being rebuilt by hand.

News monitoring

Issues that arrive pre-written: Raise an issue from a news item and the type, deadline, location and criticality are already filled in. A note tells you what was pre-filled, so you can change anything that does not fit.

Link news to work already underway: A news item can be attached to an issue you have open rather than starting a new one, which keeps a developing story in one place.

Easier to spot: The news monitoring column has moved to the front of the third-party table, where you will actually see it.

Admin self-service

Control assessment emails can now be edited in “Communication” alongside your other templates, custom fields can be deleted or archived without asking us, and scheduled assessments can be deleted when plans change.

Quality of life changes

• Audit trail: Exports are now recorded in the audit log, showing who ran the export, what they exported, how many records it covered and when. Useful when someone needs to account for data leaving the platform.

• Document analyser: The AI document analyser now works in the Internal Control module as well, so you can pull details out of an uploaded document without leaving the control you are working on.

Looking ahead

Next up: a public API and developer portal so you can build on the platform directly, work on mapping the third parties behind your third parties, archiving and restoring so finished records can be put away without disappearing, a DocuSign integration, and a single view of screening results for individuals and entities. Plenty more brewing.

Stay tuned, and we will see you soon.

- 3rdRisk Product Team