Vendor assurance is how your company reviews the suppliers that handle personal data for it. You write a questionnaire, prepare a review for each supplier, record their answers with evidence, and then the company decides whether to accept them.
Who can do this
- Anyone who can edit records, which is an owner, editor or contributor, can write questionnaires, prepare reviews and record answers.
- Only an owner or editor can record the company's review decision, because it accepts a risk.
Before you start
Record the supplier first under Records & controls → Data processors.
Find it
Open Records & controls → Data processors and press Vendor assurance. Vendor reviews assigned to you also appear in My work, under Vendor review work. Press Open supplier register to go back to your suppliers.
Write a questionnaire
- Press Author questionnaire.
- Give the Questionnaire name.
- Write each question and the criterion an answer must meet. Tick whether the criterion is required and whether it needs exact confirmation evidence. Press Add company question for another, up to 50.
- Give a Reason and press Save questionnaire.
To change it later, use Revise questionnaire.
Prepare a review
- Press Prepare vendor review. The form has steps.
- Choose the Existing supplier.
- Choose the Declared impact tier, Low, Medium, High or Critical, and explain it under Tier rationale.
- Choose the Actual company owner of the relationship.
- Set the Review interval in days and the Next review date.
- Choose the Current company questionnaire.
- Give a Reason and press Save review scope.
Record the answers
Press Record answers on the review. For each question, give the answer and choose its criterion state: Unknown, Company confirmation recorded, Criterion gap or Declared not applicable with rationale. Say whether the company recorded it itself or from the supplier's response, attach the exact confirmation evidence, and link a supplier finding if there is a gap. Press Save answers.
Record the company review
An owner or editor presses Record company review, chooses the Company decision, Accepted, Accepted with assigned actions or Rejected, writes the Review rationale, sets the Review expiry, gives a Reason, and presses Save company review.
What the status means
A review shows where it stands, for example Required answers missing, Company review required, Company review current, Company review current with assigned actions, Review overdue or Review expired. A status such as Current evidence required or Current supplier facts required means something the review relied on has changed since.
Common questions
"Can a contributor accept a supplier?" No. Recording the company review accepts a risk, which only an owner or editor can do.
"Why does the review say Current questionnaire required?" The questionnaire changed after the review was prepared. Choose the current one under Revise review scope.