Review a vendor's answers, check the evidence and challenge a weak answer

Steps

1. 1

   Find the vendor that has answered

   In Data Protection, select Vendor risk. A vendor whose answers are waiting for you shows To review under Latest assessment. Select the vendor's name.

2. 2

   Open the submitted questionnaire

   On the vendor's page, Assessment history shows the questionnaire as To review, with every question answered and a residual risk score. Select Review.

   • Select Review
3. 3

   Read what to do next

   The box at the top says Submitted: review each answer, raise findings, then ask for approval. Its buttons are Recalculate score, Raise finding, Return to vendor, Request approval and Cancel assessment.

4. 4

   Read the four score tiles

   Inherent risk is the risk before safeguards, out of one hundred. Control score is how well the vendor's answers show that it protects the data. Residual risk is what is left, and it sets the tier: Low, Medium, High or Critical. The line underneath shows the calculation and the score at which each tier starts.

5. 5

   See where the marks were lost

   Controls by section shows the marks earned in each section of the questionnaire. Here Security of processing and Personal data breaches are below one hundred percent, so those are the answers to read first. A section with no scored questions shows Not scored.

6. 6

   Download the answers

   At the top right, select Download and choose CSV. You get a file with every question, answer and score, which you can keep with the vendor's contract. JSON gives the same content for another system.

   • Select Download
   • Select CSV (Excel, all rows)
7. 7

   Open the evidence the vendor attached

   Scroll down to Answers. Each question shows the vendor's answer, who gave it and any file attached. Select the file name to download it. Check that the certificate is current and covers the service you use. The short code beside the name is a fingerprint of the file, which proves it has not changed.

   • Select swiftparcel-iso27001-certificate.png

   

8. 8

   Accept an answer you are satisfied with

   Select Accept on an answer you have checked. It is marked Accepted. Accepting is your own record of what you have reviewed, and it does not change the score.

   • Select Accept
9. 9

   Select Challenge on a weak answer

   The vendor says it would tell you about a breach within 72 hours. That leaves you no time to meet your own deadline with the regulator. Select Challenge on that answer.

   • Select Challenge
10. 10

    Say what the vendor should change

    Type what the vendor should change or explain. The vendor sees this comment beside the question when the questionnaire goes back. Then select Challenge.

    • Type What should the vendor change or explain?: We must report a breach to the regulator quickly ourselves. Please con…
    • Select Challenge
11. 11

    Select Return to vendor

    Go back to the top. The button now reads Return to vendor, with the number one in brackets for the one challenged answer. Select it.

    • Select Return to vendor (1)
12. 12

    Add a note and a new due date

    Write a short note to the vendor and, if they need more time, a new due date. Clear Email the link to the contact if you will tell the vendor yourself, as here. Then select Return to vendor.

    • Type Note to the vendor: One answer needs your attention. Everything else is fine.
    • Type New due date (optional): 2026-11-10
    • Select Email the link to the contact
    • Select Return to vendor
13. 13

    Copy the link for the vendor

    The questionnaire link works again until the vendor resubmits. Because no e-mail was sent, the link is shown for you to copy. Select Copy link, then Done.

    • Select Copy link
    • Select Done
14. 14

    Check the new status

    The assessment now shows Returned to vendor and Link live, and the box at the top reads Returned to the vendor for changes. The next lesson shows what the vendor sees.