Separately from questionnaire assessments, Vendor Pulse lets you send specific identified risks to a vendor and ask them to respond. The vendor logs in to a portal, describes how they will handle each risk, uploads supporting evidence, and submits.
In the product this is called a risk evaluation. You mark the risks you want the vendor to respond to, then send them all together with a single expiry date.
This guide covers marking risks, sending them, what the vendor does, and how you review their response.
vendor:risk:view to open the Manage Risk tabvendor:risk:add to see the row menu that contains Mark EvaluationNavigation: Sidebar → Vendors → [select a vendor] → Manage Risk tab
The Manage Risk table lists every risk recorded against that vendor.
| Column | What it shows |
|---|---|
| Risk Title | The name of the risk |
| Evaluation Date | The date the risk was last sent to the vendor. If it has never been sent, a red Pending chip appears instead |
| Risk Source | Where the risk came from — DRM, Assessment or Manual |
| Risk Severity | Info, Low, Medium, High or Critical |
| Status | Pending, Planning, In Progress, On Hold, Completed or Waived |
| Due Date | Your internal target date for the risk |
| Assigned By | Who created the risk |
| Assigned To | Who owns the risk internally |
Above the table you have a Status filter (Choose Status), a search box, and an Add Risk button.
A marked risk shows a small green ticket icon next to its title. Hovering it reads: "The following risk has been selected for vendor evaluation and has not yet been sent."
To un-mark a risk, open the ⋮ menu again and choose Unmark Evaluation.
Mark Evaluation only appears on risks whose status is Pending, Planning or In Progress. Risks that are On Hold, Completed or Waived cannot be marked.
As soon as at least one risk is marked, a Risk Evaluation Actions button appears in the table header.
To clear every mark without sending anything, choose Reset Selected from the same Risk Evaluation Actions menu.
The evaluation is emailed to the vendor's SPOC. Copied in are:
The email refers to the assessment as Risk Evaluation and carries the expiry date you set.
If the vendor already has an open risk evaluation whose expiry date has not passed, newly sent risks are added to that same evaluation rather than creating a second one. The vendor sees them alongside the risks they already had.
The vendor opens the link and signs in with a one-time code — there is no password. The dialog shows Verify OTP, with Resend OTP and Submit.
Once in, the screen has a list panel on the left with each risk sent to them, and the working area on the right.
For the selected risk the vendor sees the Risk Details panel:
| Field | Required | Notes |
|---|---|---|
| Risk Description | — | Read-only. The description you wrote |
| Response Strategy | Yes | How they intend to handle the risk |
| Response Plan | Yes | Free text |
| Mitigation Strategy | Yes | — |
| Mitigation Plan | No | Free text |
| Controls | No | Free text |
Each field has an information icon explaining what is expected. The vendor saves with Save & Proceed.
Alongside the details is the Evidences panel with an Upload Evidence control. Uploading opens a Confirm Evidence Upload step, finished with Confirm Upload. Until documents are added the panel reads "No Evidences Detected". Accepted files are .pdf, .xlsx, .xls, .doc, .docx, .jpg, .jpeg and .png, up to 15 MB per file.
Each uploaded document carries an approval state that your team controls: Pending, Approved or Rejected.
The same screen has a Comments area with Add Comment and a Recent Comments list, so your team and the vendor can discuss a risk in place.
The vendor finishes with Submit Evaluation. A Submit Evaluation Confirmation dialog warns that the action cannot be undone, and they complete it with Confirm Submit.
Submission is blocked while any risk has no evidence attached. The vendor is told how many risks are still incomplete and that evidence is required on each.
When the evaluation is submitted, the vendor's relationship manager is notified by email.
The evaluation link is sent to the vendor's SPOC, and the one-time code goes to the SPOC's email address. The risk evaluation portal has no Add Collaborator option — the team roles (Admin, Collaborator, Viewer) described in Vendor Assessment Portal Guide (For Vendors) apply to questionnaire assessments, not to risk evaluations. The portal stops letting the vendor in once the expiration date you set has passed.
The risk opens on a four-stage lifecycle:
From here you can read the vendor's response and plans, review the evidence they attached, and move the risk along its lifecycle. View Comments opens the Comments drawer for the conversation on that risk.
If you post a comment and spot a mistake, hover it and click the Edit (pencil) icon. The comment becomes a text box with Close and Save, and afterwards carries an italic (edited) marker whose tooltip shows the edit date. You can also delete your own comment with the Delete (bin) icon.
Two limits apply:
Mentioning the same person twice in one comment sends them one notification, not two.
| Questionnaire Assessment | Risk Evaluation | |
|---|---|---|
| Where you start it | Vendor's Assessment Process tab | Vendor's Manage Risk tab |
| What is sent | A template of questions | Specific risks you marked |
| What the vendor does | Answers questions | Gives a response and mitigation plan, plus evidence |
| Template needed | Yes, from Master Data | No — it uses risks that already exist |
| Evidence mandatory to submit | Depends on the question | Yes, on every risk |
Sending fails with a message about the SPOC email → The vendor has no SPOC email recorded. Add it on the vendor's profile and send again. A vendor also needs its SPOC contact fully set up before an evaluation can be issued.
I can't see the ⋮ menu on risk rows → The row menu only appears for users with vendor:risk:add. Ask your administrator to grant it.
Mark Evaluation is missing on a particular risk → That risk is On Hold, Completed or Waived. Only Pending, Planning and In Progress risks can be marked.
The Risk Evaluation Actions button is not there → It only appears once at least one risk is marked. Mark a risk first.
Sending is rejected because a risk is already completed → Risks with status Completed cannot be sent. Un-mark them and send the rest.
I sent more risks and no new evaluation appeared → That is expected when the vendor already has an open evaluation that has not expired — the new risks were added to it.
The vendor cannot submit → Every risk in the evaluation needs at least one evidence document. The vendor is shown which risks are still incomplete.
The vendor cannot sign in → Sign-in is by one-time code sent to the SPOC's email address. Check the address on the vendor's profile, and ask them to check their spam folder and use Resend OTP.
The vendor is told the risk assessment has expired → The Risk Evaluation Expiration Date has passed. Mark the risks again and send a new evaluation with a later date.
The Edit action on my comment has gone → Comments can only be edited by their author, and only within 15 minutes of posting. Post a follow-up comment instead.
Need more help? Contact support@zeron.one