Skip to content
Aavenir Atlas early access is open Contractflow on the ServiceNow Store since 2019 Runs on ServiceNow, or standalone ProcureTech100 2025/26 Pioneering Digital Solution ISO/IEC 27001:2022 certified, SOC 2 Type 2 compliant

Glossary

What is ServiceNow TPRM?

ServiceNow Third-Party Risk Management is a ServiceNow application that automates vendor questionnaires, risk assessments and follow up in one place.

Schedule a Demo All Glossary Terms

What it does

Third-Party Risk Management, previously called Vendor Risk Management, runs on the ServiceNow platform and connects with its other workflows. It keeps a central inventory of third parties, sends and collects questionnaires, scores risk, tracks issues to closure and reports on the state of third-party risk across the business.

Why third-party risk needs a system

Most organizations rely on hundreds of suppliers, service providers and partners, and each one can introduce security, compliance, financial or operational risk. Regulators increasingly expect firms to show they know their third parties and monitor them over time. Spreadsheets and email cannot keep up with that volume or produce the evidence an auditor asks for.

Key capabilities

  • Automated onboarding questionnaires and evidence collection.
  • Risk scoring and tiering so effort follows criticality.
  • Issue and remediation tracking with owners and due dates.
  • Ongoing monitoring and periodic reassessment.
  • Reporting for risk committees and regulators.

How Aavenir handles it

Onboardingflow collects supplier data and documents at onboarding, and Obligationflow tracks the security, audit and notice duties written into each contract. Both run natively on ServiceNow, next to its third-party risk records. See third-party risk and contracts.

Keep reading

ServiceNow VRM ServiceNow Vendor Risk Management was the ServiceNow application for vendor risk, now part of Third-Party Risk Management.Read more ServiceNow GRC ServiceNow GRC is the ServiceNow suite for governance, risk and compliance: policies, risks, audits and third parties.Read more Vendor risk assessment A vendor risk assessment identifies and rates the risks a supplier brings, from security to financial health.Read more

Frequently asked questions (FAQ)

Common questions

What is the difference between TPRM and VRM in ServiceNow?

Vendor Risk Management was the earlier name. Third-Party Risk Management replaces it and widens the scope to every third party, not only vendors, with more automation in assessments and monitoring. Read about ServiceNow VRM.

Who owns third-party risk management?

Ownership is shared. Risk or compliance usually sets the framework, procurement brings third parties in, security reviews data and system access, and business owners answer for how each third party is used. Read about ServiceNow GRC.

Why do contracts matter for third-party risk?

The contract sets what a third party must do: security controls, audit rights, breach notice and exit support. Without those terms tracked, a risk assessment cannot tell whether the third party is meeting them. See Obligationflow.

Have a question we have not answered? Ask the Expert

Schedule a demo

See your contracts run on one record.

  • 1 A 30 minute walkthrough Built around your team, whether that is procurement, legal, IT or finance.
  • 2 Your contracts, not ours Bring a few sample agreements and watch Aavenir AI extract and review them.
  • 3 ServiceNow or standalone We show the deployment that fits the systems you already run.

Prefer to talk first? Contact the team.