Assessments
Send, track and review vendor assessments
An assessment is one questionnaire sent to one vendor at one point in time. This page covers sending it, chasing it, and reviewing what comes back.
Sending an assessment
Choose the questionnaire
Pick the questionnaire and the language. The language decides which localized question text the vendor sees.
Choose recipients
The vendor's primary contact is the default. Add others if the questionnaire spans teams — each recipient gets a token of their own.
Set a deadline
The deadline drives both the reminder schedule and the token expiry. Sending
records an invitation sent activity and puts the assessment in Scheduled.
While it is open
Tokens
Each recipient holds a token that is pending until they open the link, then
opened, and completed on submit. Tokens also end up expired when the
deadline passes or revoked when you cut access off.
You can reissue an invitation to a new address, extend a token, extend the deadline, or revoke a recipient outright. Each of those is recorded on the assessment activity log.
Reminders
Reminders go out automatically ahead of the deadline and are logged as
reminder sent. An assessment nobody answers ends up expired, or you can close
it as non-cooperative, which is recorded distinctly from an ordinary cancellation.
The activity log
Every meaningful event lands on the log with its actor — the vendor, one of your users, or the system: submissions and resubmissions, answer edits, evidence uploaded or removed, changes requested, reports generated, deadline changes and expiry. This is the audit trail when someone asks why an assessment looks the way it does.
Reviewing
A submitted assessment moves to Pending review.
Answers and findings
Work through the answers section by section. Findings raised by the answers are already attached — an option that indicates a gap carries its finding with it. Comments on findings are threaded, and read state is tracked per user, so a second reviewer can see what is new.
Requesting changes
If an answer is thin or the evidence is missing, request changes. This reopens the relevant tokens so the vendor can get back in and resubmit; the resubmission is logged separately from the original.
Evidence
Attach files the vendor sent through other channels, or edit answers directly where you have better information. Both are recorded as platform-side activity rather than presented as the vendor's own words.
After completion
Completion is not the end of the work. Two fields track the follow-up:
- Validation process — in process, implementing findings, or done.
- Closure status — in process, findings rejected by the vendor, or completed.
Mitigation requests track the specific fixes you asked the vendor for and where each one stands.