Summarize Third-Party Risk Management issues including vendor risk exposure, assessment gaps, remediation status, and compliance impact across the TPRM lifecycle
Summarize Third-Party Risk Management issues including vendor risk exposure, assessment gaps, remediation status, and compliance impact across the TPRM lifecycle
GET /api/now/table/sn_tprm_issue?sysparm_query=active=true^ORDERBYDESCpriority&sysparm_fields=sys_id,number,short_description,description,state,priority,vendor,assessment,remediation_plan,due_date,assigned_to,category,risk_rating&sysparm_limit=200&sysparm_display_value=true
Step 2: Gather Vendor Assessment Context
For each vendor with issues, retrieve their assessment history and current risk posture.
GET /api/now/table/sn_tprm_vendor_assessment?sysparm_query=vendor=[vendor_sys_id]&sysparm_fields=sys_id,vendor,assessment_status,overall_risk,last_assessment_date,next_assessment_date,risk_tier,assessment_score&sysparm_limit=10&sysparm_display_value=true
Step 3: Identify Assessment Gaps
Find vendors with overdue or missing assessments to highlight blind spots.
Using MCP:
Tool: SN-Execute-Background-Script
Parameters:
script: |
var gaps = [];
var va = new GlideRecord('sn_tprm_vendor_assessment');
va.addQuery('next_assessment_date', '<', new GlideDateTime().toString());
va.addOrCondition('assessment_status', 'incomplete');
va.addOrCondition('assessment_status', 'not_started');
va.query();
while (va.next()) {
var vendor = new GlideRecord('core_company');
vendor.get(va.vendor);
gaps.push({
vendor_name: vendor.name.toString(),
vendor_sys_id: va.vendor.toString(),
assessment_status: va.assessment_status.getDisplayValue(),
overall_risk: va.overall_risk.getDisplayValue(),
risk_tier: va.risk_tier.getDisplayValue(),
last_assessment: va.last_assessment_date.toString(),
next_assessment: va.next_assessment_date.toString(),
days_overdue: gs.dateDiff(va.next_assessment_date.toString(), new GlideDateTime().toString(), true)
});
}
gs.info('ASSESSMENT GAPS (' + gaps.length + ' vendors):\n' + JSON.stringify(gaps, null, 2));
description: "TPRM: Identify vendors with overdue or incomplete assessments"
Step 4: Generate Vendor Risk Exposure Summary
Produce aggregate metrics across all vendors and risk tiers.
Using MCP:
Tool: SN-Execute-Background-Script
Parameters:
script: |
var summary = {
generated_date: new GlideDateTime().toString(),
issue_overview: { total_open: 0, critical: 0, high: 0, medium: 0, low: 0, overdue: 0 },
by_vendor: {},
by_category: {},
remediation_status: { with_plan: 0, without_plan: 0, plan_overdue: 0 },
assessment_coverage: { total_vendors: 0, assessed_current: 0, assessed_overdue: 0, never_assessed: 0 },
risk_tier_distribution: {}
};
var now = new GlideDateTime();
// Issue metrics
var gr = new GlideRecord('sn_tprm_issue');
gr.addQuery('active', true);
gr.query();
while (gr.next()) {
summary.issue_overview.total_open++;
var pri = gr.priority.toString();
if (pri == '1') summary.issue_overview.critical++;
else if (pri == '2') summary.issue_overview.high++;
else if (pri == '3') summary.issue_overview.medium++;
else summary.issue_overview.low++;
if (gr.due_date.toString() && new GlideDateTime(gr.due_date.toString()).compareTo(now) < 0) {
summary.issue_overview.overdue++;
}
var vendorName = gr.vendor.getDisplayValue() || 'Unknown';
summary.by_vendor[vendorName] = (summary.by_vendor[vendorName] || 0) + 1;
var cat = gr.category.getDisplayValue() || 'Uncategorized';
summary.by_category[cat] = (summary.by_category[cat] || 0) + 1;
if (gr.remediation_plan.toString()) {
summary.remediation_status.with_plan++;
if (gr.due_date.toString() && new GlideDateTime(gr.due_date.toString()).compareTo(now) < 0) {
summary.remediation_status.plan_overdue++;
}
} else {
summary.remediation_status.without_plan++;
}
}
// Assessment coverage
var va = new GlideRecord('sn_tprm_vendor_assessment');
va.query();
while (va.next()) {
summary.assessment_coverage.total_vendors++;
var tier = va.risk_tier.getDisplayValue() || 'Untiered';
summary.risk_tier_distribution[tier] = (summary.risk_tier_distribution[tier] || 0) + 1;
if (!va.last_assessment_date.toString()) {
summary.assessment_coverage.never_assessed++;
} else if (va.next_assessment_date.toString() && new GlideDateTime(va.next_assessment_date.toString()).compareTo(now) < 0) {
summary.assessment_coverage.assessed_overdue++;
} else {
summary.assessment_coverage.assessed_current++;
}
}
gs.info('TPRM EXECUTIVE SUMMARY:\n' + JSON.stringify(summary, null, 2));
description: "TPRM: Generate executive risk exposure summary"
Step 5: Analyze Remediation Effectiveness
Evaluate how effectively issues are being remediated across the vendor portfolio.
Using MCP:
Tool: SN-Execute-Background-Script
Parameters:
script: |
var remediation = {
avg_days_to_close: 0,
closed_on_time: 0,
closed_late: 0,
still_open_on_time: 0,
still_open_overdue: 0,
top_overdue_vendors: []
};
var now = new GlideDateTime();
var closedDays = [];
// Closed issues - resolution time
var closed = new GlideRecord('sn_tprm_issue');
closed.addQuery('active', false);
closed.addQuery('closed_at', '>=', gs.daysAgo(180));
closed.query();
while (closed.next()) {
var created = new GlideDateTime(closed.sys_created_on.toString());
var closedAt = new GlideDateTime(closed.closed_at.toString());
var days = gs.dateDiff(created.toString(), closedAt.toString(), true);
closedDays.push(parseInt(days));
if (closed.due_date.toString() && closedAt.compareTo(new GlideDateTime(closed.due_date.toString())) <= 0) {
remediation.closed_on_time++;
} else {
remediation.closed_late++;
}
}
if (closedDays.length > 0) {
var total = 0;
for (var i = 0; i < closedDays.length; i++) total += closedDays[i];
remediation.avg_days_to_close = Math.round(total / closedDays.length);
}
// Open issues - on-time vs overdue
var vendorOverdue = {};
var open = new GlideRecord('sn_tprm_issue');
open.addQuery('active', true);
open.query();
while (open.next()) {
if (open.due_date.toString() && new GlideDateTime(open.due_date.toString()).compareTo(now) < 0) {
remediation.still_open_overdue++;
var v = open.vendor.getDisplayValue() || 'Unknown';
vendorOverdue[v] = (vendorOverdue[v] || 0) + 1;
} else {
remediation.still_open_on_time++;
}
}
// Sort vendors by overdue count
var sorted = Object.keys(vendorOverdue).sort(function(a, b) { return vendorOverdue[b] - vendorOverdue[a]; });
for (var j = 0; j < Math.min(5, sorted.length); j++) {
remediation.top_overdue_vendors.push({ vendor: sorted[j], overdue_count: vendorOverdue[sorted[j]] });
}
gs.info('REMEDIATION ANALYSIS:\n' + JSON.stringify(remediation, null, 2));
description: "TPRM: Analyze remediation effectiveness across vendor portfolio"
Step 6: Generate Compliance Impact Narrative
Search for issues with regulatory or compliance implications.
Using MCP:
Tool: SN-Natural-Language-Search
Parameters:
table_name: sn_tprm_issue
query: "third-party vendor issues related to data privacy, GDPR, SOC 2, regulatory compliance, or security controls"
limit: 30
Risk Tiering: Always segment vendor analysis by risk tier (critical, high, medium, low) to prioritize attention and resources appropriately
Assessment Currency: Flag any Tier 1 or Tier 2 vendor whose assessment is more than 12 months old as an immediate gap
Remediation SLAs: Define clear remediation timelines by issue severity: Critical (30 days), High (60 days), Medium (90 days), Low (180 days)
Trend Analysis: Include quarter-over-quarter trends to show whether the vendor risk posture is improving or degrading
Concentration Risk: Highlight vendors with disproportionate numbers of open issues, which may indicate systemic risk management failures
Fourth-Party Awareness: Note any vendor issues that stem from their subcontractors or fourth-party dependencies
Regulatory Mapping: Map TPRM issues to specific regulatory requirements (OCC, FFIEC, GDPR) for examination readiness
Troubleshooting
Empty Vendor Assessment Records
Symptom: sn_tprm_vendor_assessment returns no results for known vendors
Cause: Vendor assessments may use a different relationship model or the vendor record is in core_company but not linked to TPRM
Solution:
Verify the vendor reference field name. Some configurations use entity or company instead of vendor.
Assessment Score Fields Return Null
Symptom: Assessment scores are empty despite completed assessments
Cause: Scoring may be calculated at the questionnaire response level, not stored on the assessment record
Solution: Query sn_tprm_assessment with the assessment sys_id to check for child questionnaire records or asmt_metric_result entries that hold the computed scores.
Issue-to-Vendor Linkage Missing
Symptom: Issues show no vendor association in query results
Cause: Issues may be linked via the assessment record rather than directly to the vendor
Solution: Join through the assessment reference: query the issue's assessment field, then read the assessment record to find its vendor field.
Examples
Example 1: Quarterly Vendor Risk Committee Report
Scenario: VP of Risk needs a portfolio-wide TPRM summary for the quarterly committee meeting.
Tool: SN-Natural-Language-Search
Parameters:
table_name: sn_tprm_issue
query: "all open third-party risk issues with critical or high priority updated in the last quarter"
limit: 50
Generated Summary:
Total Open Issues: 83 across 34 vendors (down from 91 last quarter)
