Screen reference
Vendors
The register of third parties your services depend on: the risk they carry, the date of their last assessment.
What the screen is for
It is the basis for the "provider" field of AI systems.
Who can do what
| Action | Reader | Compliance manager | Jira administrator |
|---|---|---|---|
| Read the register | yes | yes | yes |
| Add, edit, assess | no | yes | yes |
Step by step
- Filter: Active, Critical, To assess, Without owner, Contract ended, Rejected, Conditional.
- "Add a vendor": name, service provided, risk tier (Critical, High, Medium, Low), critical function, personal data, owner, contract end. An active vendor has an owner. A vendor supporting a critical function is rated critical or high: a lower tier is raised.
- In the drawer, "Assess" records a questionnaire or an evaluation (outcome: Approved, Conditional, Rejected), with a date and, if you have one, the identifier of a proof already filed in the app. An assessment stays on file; the next replaces it in the due-date calculation.
- The assessment state (Never assessed, Due for renewal, Up to date) comes from the tier and the date.
Import vendors
"Import" and "Download the template" (for whoever edits vendors) create or correct vendors from an Excel workbook, with a preview before writing. See Import and export with Excel templates.
Prompts on the screen
The drawer flags an assessment that rejected the vendor ("remove it from the register or accept the risk in writing"), a conditional approval, and an ended contract with a vendor still active. The app does not record the risk or the decision itself: that is for you to note.
Known limits
- Rejecting a vendor triggers no automatic action (offboarding or risk acceptance).
- The register is a basis for the DORA register of information but does not generate it yet.
Was this page helpful?