Summarize Third-Party Risk Management issues including vendor risk exposure, assessment gaps, remediation status, and compliance impact across the TPRM lifecycle
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Summarize Third-Party Risk Management issues including vendor risk exposure, assessment gaps, remediation status, and compliance impact across the TPRM lifecycle
GET /api/now/table/sn_tprm_issue?sysparm_query=active=true^ORDERBYDESCpriority&sysparm_fields=sys_id,number,short_description,description,state,priority,vendor,assessment,remediation_plan,due_date,assigned_to,category,risk_rating&sysparm_limit=200&sysparm_display_value=true
Step 2: Gather Vendor Assessment Context
For each vendor with issues, retrieve their assessment history and current risk posture.
GET /api/now/table/sn_tprm_vendor_assessment?sysparm_query=vendor=[vendor_sys_id]&sysparm_fields=sys_id,vendor,assessment_status,overall_risk,last_assessment_date,next_assessment_date,risk_tier,assessment_score&sysparm_limit=10&sysparm_display_value=true
Step 3: Identify Assessment Gaps
Find vendors with overdue or missing assessments to highlight blind spots.
Using MCP:
Tool: SN-Execute-Background-Script
Parameters:
script: |
var gaps = [];
var va = new GlideRecord('sn_tprm_vendor_assessment');
va.addQuery('next_assessment_date', '<', new GlideDateTime().toString());
va.addOrCondition('assessment_status', 'incomplete');
va.addOrCondition('assessment_status', 'not_started');
va.query();
while (va.next()) {
var vendor = new GlideRecord('core_company');
vendor.get(va.vendor);
gaps.push({
vendor_name: vendor.name.toString(),
vendor_sys_id: va.vendor.toString(),
assessment_status: va.assessment_status.getDisplayValue(),
overall_risk: va.overall_risk.getDisplayValue(),
risk_tier: va.risk_tier.getDisplayValue(),
last_assessment: va.last_assessment_date.toString(),
next_assessment: va.next_assessment_date.toString(),
days_overdue: gs.dateDiff(va.next_assessment_date.toString(), new GlideDateTime().toString(), true)
});
}
gs.info('ASSESSMENT GAPS (' + gaps.length + ' vendors):\n' + JSON.stringify(gaps, null, 2));
description: "TPRM: Identify vendors with overdue or incomplete assessments"
Step 4: Generate Vendor Risk Exposure Summary
Produce aggregate metrics across all vendors and risk tiers.
Using MCP:
Tool: SN-Execute-Background-Script
Parameters:
script: |
var summary = {
generated_date: new GlideDateTime().toString(),
issue_overview: { total_open: 0, critical: 0, high: 0, medium: 0, low: 0, overdue: 0 },
by_vendor: {},
by_category: {},
remediation_status: { with_plan: 0, without_plan: 0, plan_overdue: 0 },
assessment_coverage: { total_vendors: 0, assessed_current: 0, assessed_overdue: 0, never_assessed: 0 },
risk_tier_distribution: {}
};
var now = new GlideDateTime();
// Issue metrics
var gr = new GlideRecord('sn_tprm_issue');
gr.addQuery('active', true);
gr.query();
while (gr.next()) {
summary.issue_overview.total_open++;
var pri = gr.priority.toString();
if (pri == '1') summary.issue_overview.critical++;
else if (pri == '2') summary.issue_overview.high++;
else if (pri == '3') summary.issue_overview.medium++;
else summary.issue_overview.low++;
if (gr.due_date.toString() && new GlideDateTime(gr.due_date.toString()).compareTo(now) < 0) {
summary.issue_overview.overdue++;
}
var vendorName = gr.vendor.getDisplayValue() || 'Unknown';
summary.by_vendor[vendorName] = (summary.by_vendor[vendorName] || 0) + 1;
var cat = gr.category.getDisplayValue() || 'Uncategorized';
summary.by_category[cat] = (summary.by_category[cat] || 0) + 1;
if (gr.remediation_plan.toString()) {
summary.remediation_status.with_plan++;
if (gr.due_date.toString() && new GlideDateTime(gr.due_date.toString()).compareTo(now) < 0) {
summary.remediation_status.plan_overdue++;
}
} else {
summary.remediation_status.without_plan++;
}
}
// Assessment coverage
var va = new GlideRecord('sn_tprm_vendor_assessment');
va.query();
while (va.next()) {
summary.assessment_coverage.total_vendors++;
var tier = va.risk_tier.getDisplayValue() || 'Untiered';
summary.risk_tier_distribution[tier] = (summary.risk_tier_distribution[tier] || 0) + 1;
if (!va.last_assessment_date.toString()) {
summary.assessment_coverage.never_assessed++;
} else if (va.next_assessment_date.toString() && new GlideDateTime(va.next_assessment_date.toString()).compareTo(now) < 0) {
summary.assessment_coverage.assessed_overdue++;
} else {
summary.assessment_coverage.assessed_current++;
}
}
gs.info('TPRM EXECUTIVE SUMMARY:\n' + JSON.stringify(summary, null, 2));
description: "TPRM: Generate executive risk exposure summary"
Step 5: Analyze Remediation Effectiveness
Evaluate how effectively issues are being remediated across the vendor portfolio.
Using MCP:
Tool: SN-Execute-Background-Script
Parameters:
script: |
var remediation = {
avg_days_to_close: 0,
closed_on_time: 0,
closed_late: 0,
still_open_on_time: 0,
still_open_overdue: 0,
top_overdue_vendors: []
};
var now = new GlideDateTime();
var closedDays = [];
// Closed issues - resolution time
var closed = new GlideRecord('sn_tprm_issue');
closed.addQuery('active', false);
closed.addQuery('closed_at', '>=', gs.daysAgo(180));
closed.query();
while (closed.next()) {
var created = new GlideDateTime(closed.sys_created_on.toString());
var closedAt = new GlideDateTime(closed.closed_at.toString());
var days = gs.dateDiff(created.toString(), closedAt.toString(), true);
closedDays.push(parseInt(days));
if (closed.due_date.toString() && closedAt.compareTo(new GlideDateTime(closed.due_date.toString())) <= 0) {
remediation.closed_on_time++;
} else {
remediation.closed_late++;
}
}
if (closedDays.length > 0) {
var total = 0;
for (var i = 0; i < closedDays.length; i++) total += closedDays[i];
remediation.avg_days_to_close = Math.round(total / closedDays.length);
}
// Open issues - on-time vs overdue
var vendorOverdue = {};
var open = new GlideRecord('sn_tprm_issue');
open.addQuery('active', true);
open.query();
while (open.next()) {
if (open.due_date.toString() && new GlideDateTime(open.due_date.toString()).compareTo(now) < 0) {
remediation.still_open_overdue++;
var v = open.vendor.getDisplayValue() || 'Unknown';
vendorOverdue[v] = (vendorOverdue[v] || 0) + 1;
} else {
remediation.still_open_on_time++;
}
}
// Sort vendors by overdue count
var sorted = Object.keys(vendorOverdue).sort(function(a, b) { return vendorOverdue[b] - vendorOverdue[a]; });
for (var j = 0; j < Math.min(5, sorted.length); j++) {
remediation.top_overdue_vendors.push({ vendor: sorted[j], overdue_count: vendorOverdue[sorted[j]] });
}
gs.info('REMEDIATION ANALYSIS:\n' + JSON.stringify(remediation, null, 2));
description: "TPRM: Analyze remediation effectiveness across vendor portfolio"
Step 6: Generate Compliance Impact Narrative
Search for issues with regulatory or compliance implications.
Using MCP:
Tool: SN-Natural-Language-Search
Parameters:
table_name: sn_tprm_issue
query: "third-party vendor issues related to data privacy, GDPR, SOC 2, regulatory compliance, or security controls"
limit: 30
Risk Tiering: Always segment vendor analysis by risk tier (critical, high, medium, low) to prioritize attention and resources appropriately
Assessment Currency: Flag any Tier 1 or Tier 2 vendor whose assessment is more than 12 months old as an immediate gap
Remediation SLAs: Define clear remediation timelines by issue severity: Critical (30 days), High (60 days), Medium (90 days), Low (180 days)
Trend Analysis: Include quarter-over-quarter trends to show whether the vendor risk posture is improving or degrading
Concentration Risk: Highlight vendors with disproportionate numbers of open issues, which may indicate systemic risk management failures
Fourth-Party Awareness: Note any vendor issues that stem from their subcontractors or fourth-party dependencies
Regulatory Mapping: Map TPRM issues to specific regulatory requirements (OCC, FFIEC, GDPR) for examination readiness
Troubleshooting
Empty Vendor Assessment Records
Symptom: sn_tprm_vendor_assessment returns no results for known vendors
Cause: Vendor assessments may use a different relationship model or the vendor record is in core_company but not linked to TPRM
Solution:
Verify the vendor reference field name. Some configurations use entity or company instead of vendor.
Assessment Score Fields Return Null
Symptom: Assessment scores are empty despite completed assessments
Cause: Scoring may be calculated at the questionnaire response level, not stored on the assessment record
Solution: Query sn_tprm_assessment with the assessment sys_id to check for child questionnaire records or asmt_metric_result entries that hold the computed scores.
Issue-to-Vendor Linkage Missing
Symptom: Issues show no vendor association in query results
Cause: Issues may be linked via the assessment record rather than directly to the vendor
Solution: Join through the assessment reference: query the issue's assessment field, then read the assessment record to find its vendor field.
Examples
Example 1: Quarterly Vendor Risk Committee Report
Scenario: VP of Risk needs a portfolio-wide TPRM summary for the quarterly committee meeting.
Tool: SN-Natural-Language-Search
Parameters:
table_name: sn_tprm_issue
query: "all open third-party risk issues with critical or high priority updated in the last quarter"
limit: 50
Generated Summary:
Total Open Issues: 83 across 34 vendors (down from 91 last quarter)
