Manually add a control to a third party or engagement
If you’re using both Policy and Compliance Management and Third-party Risk Management, you can associate controls with third parties and engagements. Controls can be marked as compliant or non-compliant.
Before you begin
Role required: sn_compliance.manager and sn_vdr_risk_asmt.vendor_risk_manager to associate controls in the Vendor Management Workspace.
About this task
Controls and control objectives are created and managed in Policy and Compliance Management and can then be associated with third parties or engagements.
Controls are automatically generated when you associate a policy with an entity type or an entity type with a control objective. A control is created for each entity listed in the entity type for the control objective. Controls can also be manually associated with a third party or engagement.
For more information on creating policies in Policy and Compliance Management, see Create a policy.
To understand the difference between a control objective and a control, see Structural overview of Policy and Compliance Management.
Procedure
Navigate to Workspaces > Vendor Management Workspace.
Select the list icon
and then navigate to **Third parties** > **All third parties** or **Engagements** > **All engagements**
Select the third party or engagement that you want.
Navigate to the Controls tab of the third party or engagement.
Assign a control to the engagement by selecting New.
On the form, fill in the fields.
For descriptions of all these fields, see Create new control form.
Select Submit.
For more information on managing controls, see Manage controls.
The control is associated with the third party or engagement and all related lists are visible.
Create new control form
Use the create new control form to capture all the information that you need to associate a control with a third party or engagement using the Third-party Risk Management application.
Parent Topic:Integrating Third-party Risk Management with GRC: Policy and Compliance Management
Related topics
Integrating Third-party Risk Management with GRC: Policy and Compliance Management