Vendor assessments

An assessment is a dated record of one vendor. It holds what the assessor found, what they recommend, and the vendor's risk ratings at the time the assessment was completed. It does not compute a score. The assessor sets the ratings on the vendor record, and completing the assessment copies them. A later change to the vendor therefore never changes what was found at the time. You can attach a questionnaire to collect answers. The answers are kept with the assessment, and the rating stays the assessor's decision.

Assessments live in two places: Vendors → Assessments lists every assessment in the organization, and the Assessments tab of a vendor lists that vendor's own.

Assess a vendor

1. Open Vendors → Assessments and choose Add assessment, select the vendor and continue. From a vendor's Assessments tab, Add assessment skips the selection.
2. Give the assessment a Title and an Assessor (a business role). Performed at and Next review may stay empty; completion fills them in. A new assessment always starts as a draft.
3. If you want to work from a questionnaire, open the assessment's Questionnaire tab, choose Attach questionnaire, pick one of your templates and attach it. The structure is copied into the assessment at that moment; a later edit of the template does not reach this assessment.
4. Answer the questions yourself, or send them to the vendor. Answers save as you type, and the counter above the questions shows how many required ones are answered.
5. Set or correct the vendor's ratings on the vendor record. Findings and Recommendations are written through the API. The app shows them on the assessment's detail page, but its forms do not edit them.
6. Mark the assessment as completed: open the row menu in either assessment list and choose Mark as completed.

Completing does four things. It stamps Performed at with today's date unless you entered one. It computes Next review from the vendor's Reassessment frequency, counting from the performed date; a vendor without a schedule keeps whatever next review you entered. It copies the vendor's inherent and residual ratings into the assessment. And, when it is the newest completed assessment by performed date, it becomes the vendor's latest, which is what the vendor's assessment status reads.

A completed assessment is locked. To correct it, use Reopen on its detail page or in the row menu. It returns to draft, and the vendor shows In progress until it is completed again. The history records both steps. Reopening is the only way back: the API refuses to set a completed assessment's status to draft.

To hand the work to someone else, open the assessment's menu and choose Reassign assessor, pick a different role and give a reason.

Send the questionnaire to the vendor

Plan. Sending questionnaires to vendors is available on the Business plan.

Instead of filling in the questionnaire yourself, you can let the vendor answer it over a link. The vendor needs no devguard account and sees only that one questionnaire. If your plan includes branding, the page shows the logo, colors, Company description and Company links from your Branding settings. Without a logo there, it shows the devguard logo. The page keeps the branding from the moment you sent the link; Resend link updates it.

1. On a draft assessment with a questionnaire attached, open the Questionnaire tab. The External vendor questionnaire panel sits above the questions.
2. Enter the Vendor contact email, optionally a Contact name, and choose how long the link stays valid under Link expires in (7, 14, 30, 60 or 90 days).
3. Choose Send to vendor. devguard emails the link to the contact. It also shows you the link once, so you can pass it on yourself. Copy it then; it is not shown again.

From here the panel tracks the invite: Sent to, Link expires, Submitted and Last opened, and the status moves through four states.

On the vendor's side, answers save as they go. A file question lets the vendor upload a document, which is filed on the vendor's Evidence tab. Submit for review is available once every required question is answered. Until you decide, the vendor can take the submission back with Withdraw & edit.

When the submission arrives, read it on the Questionnaire tab. Then choose one:

• Approve completes the assessment, exactly as Mark as completed would.
• Request changes sends it back to the vendor with an optional message and opens the link for editing again.

While the questionnaire is Awaiting vendor, Resend link sends a new link to the same contact, for example when the first email was lost. It keeps the original expiry date. For an expired link, Revoke it and send again; this sets a new expiry. A revoked invite cannot be used again.

While an invite is active, only the vendor writes. The internal form is read-only, and the questionnaire cannot be attached or detached. An answer saved from the app is refused with a message that the vendor is filling out the questionnaire. Revoke the link to take the work back in-house.

Fill in or hand over answers as a file

For a vendor that prefers a spreadsheet, or for answers you already have, the Questionnaire tab of a draft assessment offers Export CSV and Import CSV.

The export has one row per question with the columns questionId, section, question, guidance, type, required, allowedAnswers and answer. Only answer is meant to be edited; questionId is the key the import maps answers back on and must come back unchanged. Yes/no questions take Yes, No or N/A; single-choice questions take one option label; multiple-choice questions take several labels separated by |; text questions take free text. File questions cannot be answered through the file: upload those in the app.

The import reads the questionId and answer columns, reports how many answers it imported, and leaves the rest of the sheet alone.

Automatic reassessments

Once a day, devguard checks every vendor whose status is Active and works out when it is next due. The due date is the earlier of two dates:

• the Next review of the vendor's latest completed assessment;
• the earliest Valid until among the vendor's documents of a named type (a document of type Other does not count).

When that date has passed and the vendor has no draft assessment open, devguard creates one. Its title is Reassessment of and the vendor's name. It goes to the assessor of the vendor's most recent assessment, or to the vendor's owner if there is none. The audit log records the creation.

The draft appears in both assessment lists and on the vendor's Assessments tab, with the overdue next review date beside it. Complete it as any other assessment. If the assessment's own next review date was the trigger, the vendor also shows Overdue in the vendor list and Assessment overdue on the overview. If a document's expiry was the trigger, only the draft and the document's deadline show it.

Reference

Assessment fields

The assessments list

Vendors → Assessments searches by title, vendor or ID and filters by Status, Vendor, Assessor, Next review (with the presets Overdue, Next 7 days and Next 30 days) and Performed at (Last 30 days, Last 90 days). The Next review column marks an overdue date. Rows can be selected for a bulk delete, and the toolbar menu exports the list. The row menu holds Mark as completed, Reopen, edit and delete.

Permissions

Owners and admins manage assessments; members and auditors read them. The vendor who answers over a link is authenticated by the link alone and can reach only that one questionnaire.

API

The assessment itself is in the public API, documented in the API reference. Reopening, attaching a questionnaire, answering it, importing answers and sending it to a vendor are done in the app only.