Supplier assessment (TPRM): support reference¶
Internal. The customer-facing explanation is in the screen reference.
TPRM assesses organisations rather than systems, and the people answering are outside your organisation. Both facts shape its tickets: access problems and stalled assessments dominate, and neither is a defect.
Vendor users are a separate population¶
A supplier's staff sign in as vendor users, with vendor roles, and see only their own assessment. Three fields decide what they can do, and all three are edited on the user rather than on the assessment:
| Field | Decides |
|---|---|
| Role | Vendor POC, reviewer or administrator |
| User Type | Whether they act as client, auditor, or both |
| Allowed Audit Type | Which kinds of assessment they may open |
A vendor contact who "cannot see the questionnaire" usually has no allowed audit type covering it, or is set to the wrong user type.
OTP login can be enabled per vendor user. Where it is, sign-in depends on their mobile or email being correct on the account — a detail nobody notices until the first attempt.
Assessments stall on people, not on the platform¶
The pre-assessment moves POC → reviewer → decision, and Pending On names whose turn it is. An assessment that "isn't progressing" is nearly always waiting on a named person, and the screen already says who.
Control status and the person it is pending on are shown together for that reason.
Computed tier against final tier¶
The scorecard produces a computed tier from the answers. The final tier is what the organisation actually assigns, and it can differ — with a stated override reason.
Two consequences:
- A vendor's tier "not matching the score" is the override working as designed. The reason field says why.
- Reporting that reads the computed tier where the business acts on the final one will disagree with the business.
Scoring may be switched off¶
Scoring and manual re-assessment are configurable. Where scoring is disabled, tiers are assigned rather than calculated, and a caller expecting a score will not find one.
Evidence comes from outside¶
Vendor-supplied evidence is uploaded by people you do not administer. Where a control requires evidence, it cannot be completed without it, and chasing that is the account manager's job rather than a platform issue.
It shares screens with RLCM¶
TPRM control assessment uses the same screens as internal compliance, differing by the audit's type. A screenshot or a link from one is indistinguishable from the other — compare the audit name, not the screen.
What to collect before escalating¶
- The vendor, and the assessment's name.
- The vendor user's role, user type and allowed audit types.
- The control reference and its Pending On value.
- Whether scoring is enabled for this deployment.
- For tier disputes: the computed tier, the final tier, and the override reason.