Third-Party Risk Management (TPRM) allows organizations to identify, assess, and mitigate risks from external vendors, contractors, and partners.
This guide covers a standard automated TPRM configuration in Formalize:
Configuring Custom fields on the Supplier Card
Building a Risk Assessment Questionnaire with calculated scoring
Setting up Workflows to automate questionnaire delivery and field updates
Creating an Approval Flow to vet responses before system update
Note: This guide provides a foundational setup. You can customize fields, scoring logic, and conditions based on your organization's risk framework.
Step 1: Configure Supplier Card
Define the properties needed to track vendor risk on the Supplier card.
Go to Settings -> Resources -> Suppliers.
Add the following Custom Fields:
Business Criticality (Single Select: e.g., Low, Medium, High, Critical)
Type of Supplier (Single Select: e.g., Software Provider, Hardware, Services)
Risk Assessment (Single Select / Text: Low, Medium, High, Critical)
Date of Last Assessment (Date)
Refresh your knowledge of configuration with our Custom Fields article.
Step 2: Create the Risk Assessment Questionnaire
Build the questionnaire and set up automated quantitative scoring based on qualitative answers.
2.1 Build Questions and Enable Scoring
Go to Operations -> Questionnaires.
Click Create Questionnaire (or select a Formalize pre-built template).
Add your assessment questions using Single Select or Multiple Select field types.
For each select question:
Click Configure extra properties.
Toggle Enable numeric value.
Assign a numeric score to each option (e.g., Yes = 10, No = 0).
2.2 Add Calculated Fields and Risk Labels
Add a Numeric Calculation field to the questionnaire.
Click Formula, select your preferred calculation function, and define the scoring logic.
Define your score ranges and assign risk labels (e.g., Score 0–20 = Low, 21–50 = Medium, 51–80 = High, 81+ = Critical).
Result: The calculated risk label generated here will automatically update the Supplier Card in Step 3.2.
See the Custom Fields article in the section "Numeric calculated fields" for support on how to set this up.
Step 3: Set up Automated Workflows
Automate sending the questionnaire to new suppliers and updating their records upon completion.
3.1 Workflow A: Send Questionnaire to New Supplier
Define the logic to be implemented for the Risk Assessment questionnaire to be sent. For example: for every new Supplier added to Formalize where the fields "Business Criticality" is either "High" or "Critical" and "Type of Supplier" is "Software Provider" you want to automate sending the questionnaire "Risk Assessment".
Navigate to Operations -> Workflows, click on Create button.
Click on Builder button.
Set Trigger: Select New Supplier.
Set conditions in the Condition box.
Add Action: Create questionnaire response
Configure action settings:
Questionnaire: "Risk Assessment".
Invite respondents: Map supplier contact email fields.
Connect to triggering element: Select Yes (this attaches the questionnaire to the Supplier Card).
Toggle workflow status to Enabled.
Note: A valid email address needs to be added to Supplier card for the workflow to run.
3.2 Workflow B: Update Supplier Card Upon Questionnaire Completion
Go to Operations -> Workflows, click on Create.
Click the Builder button.
Set Trigger: Select Questionnaire response completed and choose the questionnaire "Risk Assessment".
Add Loop through a Collection and choose Suppliers. The loop allows the system to find the exact supplier connected to the questionnaire response.
Inside the loop, add Action Update Supplier.
Configure Action settings:
Select Supplier -> Model.
In Fields to update map the fields you want updated from the responses in the questionnaire. For example you can choose to update the fields created in Step 1: "Risk Assessment" and "Date of last assessment".
Toggle workflow status to Enabled.
Learn more about Workflows and its functionalities in our Workflow Builder Article. See more examples and detailed walkthroughs of the Update resource action in our Workflow Builder - update resource article.
Step 4: Set up the Approval Flow
Add a manual approval step so team members can review questionnaire responses before finalizing risk scores.
Go to Operations -> Approval Flows.
Click on Create in the top right corner and open Flow Builder.
Configure the Trigger node:
Event: Approval Flow requested.
Trigger entity: Questionnaire Response Group.
Specific questionnaire: Risk Assessment.
Trigger type: Manual.
Add an Action Node:
Enter a step name.
Select action: Create Approval Flow Step.
Assign the responsible User or Role.
