The vendor settings page provides centralized configuration for your entire TPRM program. Settings are organized into five tabs, each controlling a different aspect of vendor management.Navigate to Vendors > Settings to access these configuration options.
Add email addresses of team members who should be notified when a new intake submission is received. Multiple email addresses are supported.
Add your security team lead and procurement manager to the notification list so both teams are aware of new vendor requests immediately.
The Risk Scoring tab configures the automatic risk scoring formula applied to vendor intake submissions. See Vendor Scoring for a detailed explanation of the scoring model.
Assign numeric weights to each boolean risk factor. The list includes both built-in fields and any boolean custom fields you have defined.Built-in factors:
Define the score ranges that map to each risk level:
Risk Level
Default Lower Bound
Low
0
Medium
7
High
16
Critical
21
A vendor’s score is compared against these thresholds to determine their risk level. The score must meet or exceed the lower bound to be classified at that level.
The Custom Fields tab allows you to define additional fields that extend the vendor data model and assessment questionnaires.
Click Add Field and provide a label, field type, and optional description. For select and multi-select fields, define the available options.
2
Set Required Status
Toggle whether the field is required. Required fields must be filled on intake forms and vendor detail pages.
3
Activate or Deactivate
Fields can be deactivated without deleting them. Deactivated fields are hidden from forms but their data is preserved.
Boolean custom fields automatically become available as risk scoring factors in the Risk Scoring tab. This makes it easy to incorporate organization-specific criteria into the scoring formula.
The Approval Workflow tab configures how vendor onboarding requests are reviewed and approved.
A new intake submission or manually added vendor enters the review queue
Designated reviewers receive email notifications
A reviewer examines the submission details, risk score, and supporting documents
The reviewer approves or rejects the request with notes
If approved, the vendor record is created in the managed vendor directory
If rejected, the submitter receives notification with the rejection reason
Set the approval threshold to match your organization’s procurement policy. Vendors below the threshold can be auto-approved to reduce administrative overhead while maintaining oversight for significant relationships.
Each tab has its own save action. Changes are not automatically saved when switching between tabs. Always click the Save button within the active tab before navigating away.
Unsaved changes are lost when switching tabs. Save your changes within each tab before moving to another one.
Vendor settings are typically restricted to users with administrative or GRC manager roles. Check your organization’s role configuration in Settings > Users & Roles to ensure the appropriate team members have access to modify vendor settings.
